4f84f90b0ffe12d74745e92941615614736414d581283c4ae57c7898666f1ea2

Analysis

max time kernel
86s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2023 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Install VALORANT (1).exe
Size

67.5MB
MD5

8626becee53bdcc44fa73c271231a0fb
SHA1

82620a84762aed14c0f7aa8072329b874a19dfbe
SHA256

4f84f90b0ffe12d74745e92941615614736414d581283c4ae57c7898666f1ea2
SHA512

ff0a690187ee6dc6803a3d00cacddb2b2239a22eb28a1497a55d0474427a44b5ba7fdf8ba033bf7a7dc4fb24b7b461c0286a50c8a3310b07d11d4eee805113e8
SSDEEP

1572864:NrNItDfUCSp8K0UNl/Ywrt9E7lzPF5KBBhDIVIbjUp1xD+:peDfUBp8KnAtqBBhDIVNji

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 6 IoCs

pid	Process
3828	RiotClientServices.exe
2104	RiotClientServices.exe
2740	RiotClientCrashHandler.exe
3356	RiotClientUx.exe
2860	RiotClientServices.exe
4700	RiotClientCrashHandler.exe

Loads dropped DLL 6 IoCs

pid	Process
3828	RiotClientServices.exe
3828	RiotClientServices.exe
3828	RiotClientServices.exe
3356	RiotClientUx.exe
3356	RiotClientUx.exe
3356	RiotClientUx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 31 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\riotclient\ = "URL:Riot Games Protocol"	Install VALORANT (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\riotclient\shell\open	Install VALORANT (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\riotclient\shell\open\command\ = "\"C:\\Riot Games\\Riot Client\\RiotClientServices.exe\" --app-command=\"%1\""	Install VALORANT (1).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{05516190-a2c3-4596-9505-66d0e7913e44}\LaunchPermission = 0100148094000000a0000000140000003000000002001c000100000011001400040000000101000000000010001000000200640003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000030000b000000010800000000000f0200000076c8b566b196b8807bdf0386522d4758fa9855746bd04da4099286d401010000000000050a00000001020000000000052000000021020000	RiotClientServices.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{05516190-a2c3-4596-9505-66d0e7913e44}\AppIdFlags = "8"	Install VALORANT (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{05516190-a2c3-4596-9505-66d0e7913e44}\RunAs = "Interactive User"	Install VALORANT (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{05516190-a2c3-4596-9505-66d0e7913e44}	RiotClientServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{05516190-a2c3-4596-9505-66d0e7913e44}\ = "ExtServer"	Install VALORANT (1).exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{05516190-a2c3-4596-9505-66d0e7913e44}\AppIdFlags = "8"	RiotClientServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{05516190-a2c3-4596-9505-66d0e7913e44}\RunAs = "Interactive User"	RiotClientServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{05516190-a2c3-4596-9505-66d0e7913e44}	RiotClientServices.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{05516190-a2c3-4596-9505-66d0e7913e44}\AccessPermission = 0100148094000000a0000000140000003000000002001c000100000011001400040000000101000000000010001000000200640003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000030000b000000010800000000000f0200000076c8b566b196b8807bdf0386522d4758fa9855746bd04da4099286d401010000000000050a00000001020000000000052000000021020000	Install VALORANT (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{05516190-a2c3-4596-9505-66d0e7913e44}\ = "ExtServer"	RiotClientServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{05516190-a2c3-4596-9505-66d0e7913e44}\LocalServer32	Install VALORANT (1).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{05516190-a2c3-4596-9505-66d0e7913e44}\LaunchPermission = 0100148094000000a0000000140000003000000002001c000100000011001400040000000101000000000010001000000200640003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000030000b000000010800000000000f0200000076c8b566b196b8807bdf0386522d4758fa9855746bd04da4099286d401010000000000050a00000001020000000000052000000021020000	Install VALORANT (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\riotclient\DefaultIcon	Install VALORANT (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\riotclient\shell	Install VALORANT (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{05516190-a2c3-4596-9505-66d0e7913e44}	Install VALORANT (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\riotclient\URL Protocol	Install VALORANT (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\riotclient\shell\open\command	Install VALORANT (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{05516190-a2c3-4596-9505-66d0e7913e44}\ = "ExtServer"	RiotClientServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{05516190-a2c3-4596-9505-66d0e7913e44}	Install VALORANT (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\riotclient	Install VALORANT (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\riotclient\DefaultIcon\ = "\"C:\\Riot Games\\Riot Client\\RiotClientServices.exe\",0"	Install VALORANT (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{05516190-a2c3-4596-9505-66d0e7913e44}\AppId = "{05516190-a2c3-4596-9505-66d0e7913e44}"	RiotClientServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{05516190-a2c3-4596-9505-66d0e7913e44}\LocalServer32\ = "\"C:/Riot Games/Riot Client/RiotClientServices.exe\" --launch-background-mode"	RiotClientServices.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{05516190-a2c3-4596-9505-66d0e7913e44}\AccessPermission = 0100148094000000a0000000140000003000000002001c000100000011001400040000000101000000000010001000000200640003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000030000b000000010800000000000f0200000076c8b566b196b8807bdf0386522d4758fa9855746bd04da4099286d401010000000000050a00000001020000000000052000000021020000	RiotClientServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{05516190-a2c3-4596-9505-66d0e7913e44}\AppId = "{05516190-a2c3-4596-9505-66d0e7913e44}"	Install VALORANT (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{05516190-a2c3-4596-9505-66d0e7913e44}\ = "ExtServer"	Install VALORANT (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{05516190-a2c3-4596-9505-66d0e7913e44}\LocalServer32	RiotClientServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{05516190-a2c3-4596-9505-66d0e7913e44}\LocalServer32\ = "\"C:/Riot Games/Riot Client/RiotClientServices.exe\" --launch-background-mode"	Install VALORANT (1).exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3828	RiotClientServices.exe
3828	RiotClientServices.exe
3828	RiotClientServices.exe
3828	RiotClientServices.exe
3828	RiotClientServices.exe
3828	RiotClientServices.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2684	Install VALORANT (1).exe
Token: SeIncBasePriorityPrivilege	1780	Install VALORANT (1).exe
Token: SeIncBasePriorityPrivilege	3828	RiotClientServices.exe
Token: SeIncBasePriorityPrivilege	2104	RiotClientServices.exe
Token: SeIncBasePriorityPrivilege	3828	RiotClientServices.exe
Token: SeIncBasePriorityPrivilege	3828	RiotClientServices.exe
Token: SeIncBasePriorityPrivilege	2860	RiotClientServices.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3828	RiotClientServices.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3828	RiotClientServices.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 1780	2684	Install VALORANT (1).exe	85
PID 2684 wrote to memory of 1780	2684	Install VALORANT (1).exe	85
PID 2684 wrote to memory of 1780	2684	Install VALORANT (1).exe	85
PID 2684 wrote to memory of 3828	2684	Install VALORANT (1).exe	93
PID 2684 wrote to memory of 3828	2684	Install VALORANT (1).exe	93
PID 2684 wrote to memory of 3828	2684	Install VALORANT (1).exe	93
PID 3828 wrote to memory of 2104	3828	RiotClientServices.exe	95
PID 3828 wrote to memory of 2104	3828	RiotClientServices.exe	95
PID 3828 wrote to memory of 2104	3828	RiotClientServices.exe	95
PID 3828 wrote to memory of 2740	3828	RiotClientServices.exe	97
PID 3828 wrote to memory of 2740	3828	RiotClientServices.exe	97
PID 3828 wrote to memory of 2740	3828	RiotClientServices.exe	97
PID 3828 wrote to memory of 2860	3828	RiotClientServices.exe	101
PID 3828 wrote to memory of 2860	3828	RiotClientServices.exe	101
PID 3828 wrote to memory of 2860	3828	RiotClientServices.exe	101
PID 3356 wrote to memory of 4700	3356	RiotClientUx.exe	103
PID 3356 wrote to memory of 4700	3356	RiotClientUx.exe	103
PID 3356 wrote to memory of 4700	3356	RiotClientUx.exe	103

C:\Users\Admin\AppData\Local\Temp\Install VALORANT (1).exe
"C:\Users\Admin\AppData\Local\Temp\Install VALORANT (1).exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Users\Admin\AppData\Local\Temp\Install VALORANT (1).exe
  "C:\Users\Admin\AppData\Local\Temp\Install VALORANT (1).exe" --agent --riotclient-app-port=49738 --riotclient-auth-token=oOQm8P081oBjyfk8PgbMhg --app-root=C:/Users/Admin/AppData/Local/Temp "--data-root=C:/ProgramData/Riot Games/Metadata" "--update-root=C:/ProgramData/Riot Games/Metadata/Install VALORANT (1)/Update" "--log-root=C:/Users/Admin/AppData/Local/Riot Games/Install VALORANT (1)/Logs" "--user-data-root=C:/Users/Admin/AppData/Local/Riot Games/Install VALORANT (1)" --session-id=fa105243-c177-ed46-8fb8-edf4edf13f05
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:1780
- C:\Riot Games\Riot Client\RiotClientServices.exe
  "C:/Riot Games/Riot Client/RiotClientServices.exe" --launch-product=valorant --launch-patchline=live --force-auto-patch --shard=valorant:live:eu --locale=en_US --session-id=fa105243-c177-ed46-8fb8-edf4edf13f05 --install-flow
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Riot Games\Riot Client\RiotClientServices.exe
    "C:\Riot Games\Riot Client\RiotClientServices.exe" --agent --riotclient-app-port=49974 --riotclient-auth-token=k1Hf9FehNDhzXMWN9lUsww "--app-root=C:/Riot Games/Riot Client" "--data-root=C:/ProgramData/Riot Games/Metadata" "--update-root=C:/ProgramData/Riot Games/Metadata/Riot Client/Update" "--log-root=C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs" "--user-data-root=C:/Users/Admin/AppData/Local/Riot Games/Riot Client" --session-id=fa105243-c177-ed46-8fb8-edf4edf13f05
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2104
- - C:\Riot Games\Riot Client\RiotClientCrashHandler.exe
    "C:\Riot Games\Riot Client\RiotClientCrashHandler.exe" --no-rate-limit "--attachment=2023-06-29T20-23-40_3828_Riot_Client.0.log=C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client Logs/2023-06-29T20-23-40_3828_Riot Client.0.log" "--attachment=2023-06-29T20-23-40_3828_Riot_Client.log=C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client Logs/2023-06-29T20-23-40_3828_Riot Client.log" "--attachment=__sentry-breadcrumb1=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\200f535a-6f6a-44c2-840c-c90926a7278e.run\__sentry-breadcrumb1" "--attachment=__sentry-breadcrumb2=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\200f535a-6f6a-44c2-840c-c90926a7278e.run\__sentry-breadcrumb2" "--attachment=__sentry-event=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\200f535a-6f6a-44c2-840c-c90926a7278e.run\__sentry-event" "--database=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client" "--metrics-dir=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client" --url=https://sentry.io:443/api/1339107/minidump/?sentry_key=dc54709324504ab18ddf517a83f99e1a --initial-client-data=0x3a4,0x3a8,0x3fc,0x3f0,0x404,0x748fbc08,0x748fbc18,0x748fbc28
    3⤵
    - Executes dropped EXE
    PID:2740
- - C:\Riot Games\Riot Client\UX\RiotClientUx.exe
    "C:/Riot Games/Riot Client/UX/RiotClientUx.exe" --app-port=50018 --remoting-auth-token=MwYz9IAgRnGIkV5BY_G61Q --app-pid=3828 "--log-dir=C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs" "--user-data-root=C:/Users/Admin/AppData/Local/Riot Games/Riot Client" "--app-root=C:/Riot Games/Riot Client" --crashpad-environment=KeystoneFoundationLiveWin
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3356
  - - C:\Riot Games\Riot Client\RiotClientCrashHandler.exe
      "C:\Riot Games\Riot Client\RiotClientCrashHandler.exe" --no-rate-limit "--attachment=2023-06-29T20-23-55_3356_RiotClientUx.0.log=C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client UX Logs/2023-06-29T20-23-55_3356_RiotClientUx.0.log" "--attachment=2023-06-29T20-23-55_3356_RiotClientUx.log=C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client UX Logs/2023-06-29T20-23-55_3356_RiotClientUx.log" "--attachment=__sentry-breadcrumb1=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\RiotClientUx\65ffde60-f4fb-4866-ba8d-e3ec13870708.run\__sentry-breadcrumb1" "--attachment=__sentry-breadcrumb2=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\RiotClientUx\65ffde60-f4fb-4866-ba8d-e3ec13870708.run\__sentry-breadcrumb2" "--attachment=__sentry-event=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\RiotClientUx\65ffde60-f4fb-4866-ba8d-e3ec13870708.run\__sentry-event" "--database=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\RiotClientUx" "--metrics-dir=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\RiotClientUx" --url=https://sentry.io:443/api/1339107/minidump/?sentry_key=dc54709324504ab18ddf517a83f99e1a --initial-client-data=0x358,0x35c,0x360,0x334,0x364,0x13faff8,0x13fb008,0x13fb018
      4⤵
      Executes dropped EXE
      PID:4700
  - - C:\Riot Games\Riot Client\UX\RiotClientUxRender.exe
      "C:\Riot Games\Riot Client\UX\RiotClientUxRender.exe" --type=gpu-process --field-trial-handle=1400,16378550880489116326,6593175364416274523,131072 --disable-features=HardwareMediaKeyHandling,NetworkService --no-sandbox --log-file="C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client UX Logs/debug.log" --product-version="RiotClient/67.0.0 (CEF 74)" --lang=en-US --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --log-file="C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client UX Logs/debug.log" --service-request-channel-token=14160540016136861322 --mojo-platform-channel-handle=1408 /prefetch:2 --app-name=RiotClient --ux-name=RiotClientUx --ux-helper-name=RiotClientUxHelper --log-dir="C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client UX Logs/" --app-port=50018 --crashpad-environment=KeystoneFoundationLiveWin --user-data-root="C:/Users/Admin/AppData/Local/Riot Games/Riot Client" --app-root="C:/Riot Games/Riot Client"
      4⤵
      PID:2792
  - - C:\Riot Games\Riot Client\UX\RiotClientUxRender.exe
      "C:\Riot Games\Riot Client\UX\RiotClientUxRender.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --enable-experimental-web-platform-features --force-device-scale-factor=1 --log-file="C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client UX Logs/debug.log" --field-trial-handle=1400,16378550880489116326,6593175364416274523,131072 --disable-features=HardwareMediaKeyHandling,NetworkService --lang=en-US --log-file="C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client UX Logs/debug.log" --product-version="RiotClient/67.0.0 (CEF 74)" --disable-extensions --disable-spell-checking --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=12215873907450328861 --renderer-client-id=3 --mojo-platform-channel-handle=2316 /prefetch:1 --app-name=RiotClient --ux-name=RiotClientUx --ux-helper-name=RiotClientUxHelper --log-dir="C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client UX Logs/" --app-port=50018 --crashpad-environment=KeystoneFoundationLiveWin --user-data-root="C:/Users/Admin/AppData/Local/Riot Games/Riot Client" --app-root="C:/Riot Games/Riot Client"
      4⤵
      PID:1092
  - - C:\Riot Games\Riot Client\UX\RiotClientUxRender.exe
      "C:\Riot Games\Riot Client\UX\RiotClientUxRender.exe" --type=gpu-process --field-trial-handle=1400,16378550880489116326,6593175364416274523,131072 --disable-features=HardwareMediaKeyHandling,NetworkService --disable-gpu-sandbox --use-gl=disabled --no-sandbox --log-file="C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client UX Logs/debug.log" --product-version="RiotClient/67.0.0 (CEF 74)" --lang=en-US --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --log-file="C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client UX Logs/debug.log" --service-request-channel-token=8841799903696218473 --mojo-platform-channel-handle=3172 /prefetch:2 --app-name=RiotClient --ux-name=RiotClientUx --ux-helper-name=RiotClientUxHelper --log-dir="C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client UX Logs/" --app-port=50018 --crashpad-environment=KeystoneFoundationLiveWin --user-data-root="C:/Users/Admin/AppData/Local/Riot Games/Riot Client" --app-root="C:/Riot Games/Riot Client"
      4⤵
      PID:5800
- - C:\Riot Games\Riot Client\RiotClientServices.exe
    "C:\Riot Games\Riot Client\RiotClientServices.exe" --agent --riotclient-app-port=50018 --riotclient-auth-token=tC2ormBOsM3OThhdqr01TQ
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2860
  - - C:\ProgramData\Riot Games\Metadata\vanguard\setup.exe
      "C:/ProgramData/Riot Games/Metadata/vanguard/setup.exe"
      4⤵
      PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\7z7A408668\installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7z7A408668\installer.exe"
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\7z7A408668\vgc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7z7A408668\vgc.exe" --use-current-process
        6⤵
        
        PID:5276
  - - C:\ProgramData\Riot Games\Metadata\DirectX\DirectX_20190310.exe
      "C:/ProgramData/Riot Games/Metadata/DirectX/DirectX_20190310.exe" /silent
      4⤵
      PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DXSETUP.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DXSETUP.exe" /silent
        5⤵
        
        PID:6028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:1376

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:6140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Riot Vanguard\installer.exe

Filesize
157KB

MD5
2a8bbe9315e724ee399429e8d342aa89

SHA1
7ed60d0b2717eb06a288a09e1750999b7d159c95

SHA256
baf8a28d74d9f2d348a4e3ddce48ebe02557a0faedbdef1b1e7f1651ba6e0367

SHA512
44bf292fb9e3468304165a3fb03c5b0b60f381e65fc8ee9d0291731892bb74ed5ae789e8c89d5948f79ebf80eed86a7af6dcc9a7102881d44e9ec18796fe11d6

Download Submit
C:\Program Files\Riot Vanguard\vgc.exe

Filesize
10.5MB

MD5
395b80cdaed406f311de79b067009797

SHA1
e5d04b5bdfc6783b929277fd125d547265bacff1

SHA256
dcbf7be4bfe42c72f944ba07aedfc8142d8262d54c466ccf1a6fd92e6db319cd

SHA512
bcf78f05e7e8e325030da4fcdf88ab140b9b72c529cbe4d6b0dd16f723a3b8334dd32a7b4584c7c57ad3beb9d9c2d802cfc23d097776d535719bf9edd088e5aa

Download Submit
C:\Program Files\desktop.ini

Filesize
174B

MD5
6383522c180badc4e1d5c30a5c4f4913

SHA1
62a30e96459b694f7b22d730c460a65cd2ebaaca

SHA256
4705ba6793dc93c1bbe2a9e790e9e22778d217531b1750471206fd5c52bbd2b5

SHA512
7cf603201e13fb85873c9aa07388429cbd1ea1fbf5ee9fc785d1ca4da0cf565db70e705636bf62f600fc6c5e16fd9395a8f92cd7d60882d015dbfb087fb33f54

Download Submit
C:\ProgramData\Riot Games\machine.cfg

Filesize
39B

MD5
a7a3db0e9ae03140f83227bf90ffa25c

SHA1
9faf38a4e9681a08616608f5901c69f6a8935aa2

SHA256
dbfdf8fbecc63085e739ea6a45d0a529eecb1ffb8277fc2f2f90a9fd46ac79e8

SHA512
37bffa389ac09728b7cb702d5414d45015bd017e30b519b0fa197543fbdec97c71234d4c589acf4f7215dc1b17bd3a2a9c276b59897c50c5259cda57fe75aabf

Download Submit
C:\Riot Games\Riot Client\Microsoft.Gaming.XboxApp.Extensions.winmd

Filesize
10KB

MD5
d6abf638473c8fa2b7f88961d5402fcf

SHA1
9d0ad43bcffd5ebfccdbf3115cae2c2b3b00a472

SHA256
000d645a07789c850a7b4cb63a864cede47f9de81adc8534ec1feca3807843c0

SHA512
ca18590adbc971ec169a0d7569daa69fc623d5254612645317857d57b6de663d023e6d3e483e40027c74ee0004c5cd5a5acbb49db563e6b6e5b3cd9b9131342d

Download Submit
C:\Riot Games\Riot Client\Resources\icon.ico

Filesize
278KB

MD5
6d64639ab95a44fa7967e6a5c481662b

SHA1
34f2ad2bff7a2924e4f48cf3fa9e3ece468fda18

SHA256
ed7c539dd00734fb54c3504fc01123596f5aa3031dc0eca5160cef34de5cac5b

SHA512
a5dc9e5208e9dba9f1815676f404dbbc8923401cbdbc1765c0f76447ffb723c1864b70f79909c14b9a025889b6a59e2081d9a75de1b3164a2789da9ed967605d

Download Submit
C:\Riot Games\Riot Client\RiotClientCrashHandler.exe

Filesize
1.9MB

MD5
e9022af4e5cf995c2f2a9d897af560e9

SHA1
f6a0e432af5a1f87492d936afcadc0fb671b3da2

SHA256
76d2ad3dfa217321475a92b2f7ddf497d69e3c8537b216f83e512e4fa91c332f

SHA512
4c48a505f1d37b319ffdafafef4ca4ac7eab103d32088c3c1dad40b37036f9b73c454d030a3a15c4bbbe4935b583f162434eb6952bee35f3442d471b45932278

Download Submit
C:\Riot Games\Riot Client\RiotClientFoundation.dll

Filesize
11.4MB

MD5
e04eacfc209f114c97e81acb272243b7

SHA1
c3f4b29e21987d67495d77f2e9ae76faa554647d

SHA256
3af4543196bb2838d00dbc8921f3f92803270876d56d9b8a60915cd9f348fa7d

SHA512
62ee8dcc7dbcf2a9a985ab2bec529a2d637b1db3348eed8fa852970b780849bb8d43e7a73fa328a9232ce787ab2e842c15a22997ccf0f6a007859f8886fd25cb

Download Submit
C:\Riot Games\Riot Client\RiotClientServices.exe

Filesize
67.5MB

MD5
1837a6d4c6b5235a900cf44766b1df8b

SHA1
7e02894626e56c77363cc792541549451b716cbc

SHA256
25a5d0df795e6b6c8cbcb854ac1613e0a8e46ca0241643d686da3d2c6850a63e

SHA512
2b380d7a48d08259d3f49c9eb3e5f5c201db6bf8c7e212c735073fa513eeb35436337b661a412c8c953e43101b8b13c7e35547c8f9fa2b29267e2054a730e2b9

Download Submit
C:\Riot Games\Riot Client\RiotClientServices.exe

Filesize
67.5MB

MD5
1837a6d4c6b5235a900cf44766b1df8b

SHA1
7e02894626e56c77363cc792541549451b716cbc

SHA256
25a5d0df795e6b6c8cbcb854ac1613e0a8e46ca0241643d686da3d2c6850a63e

SHA512
2b380d7a48d08259d3f49c9eb3e5f5c201db6bf8c7e212c735073fa513eeb35436337b661a412c8c953e43101b8b13c7e35547c8f9fa2b29267e2054a730e2b9

Download Submit
C:\Riot Games\Riot Client\RiotGamesApi.dll

Filesize
20.5MB

MD5
57e0622711fad5392858fabb46fc7695

SHA1
c2c42d86e56e828c9b317db998022aba43df2d30

SHA256
797ce3343699acf89204e7f10e118711f150168ed8f52db33886da887a1a9d75

SHA512
9de27d7f3ec0912d62157bfaf156ca2a639be6321f68eb6235f1fd4b6d318913b11626e30cd95105b877e0669e203b0e0f13720a201fb6445122557ff7b23e86

Download Submit
C:\Riot Games\Riot Client\UX\cef.pak

Filesize
3.5MB

MD5
52f3fc9f9b84e341e57c4bf337b35b9f

SHA1
42425795baa91001ae79743a9e9023ec0ea5e6ad

SHA256
42b4cd144d1a6e395f9314ddf963ea65ca957a0a813d71b5f6e07ae40513c613

SHA512
4866f01ddc49b59ba44cf13628bdab7129a72cec8563bedc4664bfb2de6c0736afec2960941f17b274a4680fbaa745bde471ce623ed4f589ac31f7fe6bf4dd71

Download Submit
C:\Riot Games\Riot Client\UX\cef_100_percent.pak

Filesize
724KB

MD5
277a53a3922d71cc99626ab835cc8677

SHA1
e711062e5fef4f8c2e6fa2a0e93c0a6aca3a8056

SHA256
dae17c53566d83e24b8dbeb4329ff9a11999b05d30c2fc1d8d6a585535f6d3f8

SHA512
33d8a7843adf6c32cf6940806a0d934d67b8f6236ecbf560d226fe45180eefde35bdde97079a3f85f58188be199905255c51bc0028e4222f1440ebe51c224ba8

Download Submit
C:\Riot Games\Riot Client\UX\cef_200_percent.pak

Filesize
852KB

MD5
1822748dcb06d101954426fe75a62eb3

SHA1
8fd06ab468b681cb2818ac729594357535fbf5ec

SHA256
faded3d34e58c4dd61557f1f4c14c2dc83685a2259fdfa641f5d09eef5bbfbd5

SHA512
1315d155bce36b542d5b65def911e8e6fbb215bb11826bbe2e3f2b34f9e6163d25bbf880a59d8735aa02cd701d16d64d3ac61bb93a63234da0c4bdf22f9d08c8

Download Submit
C:\Riot Games\Riot Client\UX\cef_extensions.pak

Filesize
1.7MB

MD5
597e878419411cc2ce35029b9c44cb72

SHA1
7d2d43b1c87679fcb9f6818ed14bba2d0e330775

SHA256
eb3bfc21fa8561afbb5ce1298797b6b832b02d2b09dff878725a035e19b31da3

SHA512
0b6f29fe03181458f335b440115b8b364b8ce3da554682affa7c2832530d61ec42447a9a7cc85f709ecf93209981133d2c98b150e49486f3227c165f3ce4057b

Download Submit
C:\Riot Games\Riot Client\UX\chrome_elf.dll

Filesize
690KB

MD5
4bc92038a76a457a1c36499bd843aa1a

SHA1
0ec0ab717f116231ee1f120e958aa1876845ffb0

SHA256
6084e9d7bf40c57c141e99fd061671abbf82dda61e8567dab22d4b5fdbc0cc29

SHA512
2ad8b1432bd79879d92e0d64ac0a5f14f554683a123e7fb86622a5263c3844c218d14495f60b4987add2e2d425348b3b63c1c398ae7ab5c59f11f22f7ef3e768

Download Submit
C:\Riot Games\Riot Client\UX\d3dcompiler_47.dll

Filesize
3.5MB

MD5
d2d0ff97605d2c2f8921e93062eb01ff

SHA1
586cdca915f47fa4b1010f781ec0504e3138efd2

SHA256
4056e0804a13d791362555636ba34158fade7c1e71599e415a285de1472d83d5

SHA512
7bff38be4c5c41a978b33b9458dc885c59e68fa3dd4e56c6b980d334837bef37b2205b1b69aa1f058c0d8e24e3938c29da917a198b640b521d9726a505683b10

Download Submit
C:\Riot Games\Riot Client\UX\devtools_resources.pak

Filesize
5.7MB

MD5
766eba8610853eb8c8985a3bbe44f6f3

SHA1
41e12e3783b5210735cc8a9f8e4bcf8da43c8e36

SHA256
7e9091666d5253441fe0639d01867450623a4add8fa375a31d09e9d1b0f67026

SHA512
688e5174c931fe0e3661d4a45139b5faea5460efcd30491dd9258ad5f36872ce51646eb638c837e8784785fe1806a63e5f68e796e68eab8a5ecc98b22cfd44e6

Download Submit
C:\Riot Games\Riot Client\UX\ffmpeg.dll

Filesize
1.2MB

MD5
eae2a95bb9404eda67360ebefeb32080

SHA1
a2ba1507a815c54a91f74f3f1965ff1cceb75e13

SHA256
ebdf82bf567ba506879352053d5d670b369a41cfe783f3c177010460146518d3

SHA512
f6a06c3d678195b5c9b091e89b4493cf4012f1cf1f820f2778d28236d9566ed115feacb07f237ec79a8b71ddba3453d57233c63e079a0b498ad09b561a0e472c

Download Submit
C:\Riot Games\Riot Client\UX\icudtl.dat

Filesize
9.8MB

MD5
9705ff0fa594bb28520963db19f5471f

SHA1
0ecbb9512795e2617cf48618dd050dc0f044df3f

SHA256
66f13a0329f46e2d26fb483cb497dbdf7bb6b84d85c2e7c5bc8ea096a8bb8b1a

SHA512
a06dc6b04556692c5fd363d15590d485ce2a8bf4eb7a6a55068aade31c7db0c7b6c15249e2fc037a1b94d6ace3ecd962ad2c9cff21d50c205134189fa928788e

Download Submit
C:\Riot Games\Riot Client\UX\libEGL.dll

Filesize
108KB

MD5
e0b6f3c763f192a08115b87c4a4e94d0

SHA1
cebb858de268b5e7e8704b6b5cb3d5ab1f5614d1

SHA256
e334032ec466005f07645c3c0f5ea7722202189c4b5723ef5dad77a129549791

SHA512
41d150a16d95a12ba296f069556f7dd9fe1f20389c34a4551866e41bf68f684e44093efe0ee688710a930be6930c08c80f8ae74b00e1cea8c81f94c2db46742e

Download Submit
C:\Riot Games\Riot Client\UX\libGLESv2.dll

Filesize
4.5MB

MD5
c1649e692c3ad2286f00ea3d0c308b39

SHA1
de4eea121c46b5c78e7f00f982dd3b451cad857f

SHA256
873ef5948a0913d4487dab8ccedd3d17beff86201a0d48b111b1183772ef1bc9

SHA512
ab8fdd87765763904c7d52c71023fede5f5692f38380789ea4d90c4ff7c88b8eb59fdac471a15d399a271280ca470f2f224108495710d9922a8cfb72be11b05e

Download Submit
C:\Riot Games\Riot Client\UX\libcef.dll

Filesize
89.2MB

MD5
481df7f01a1b3a6d028790d20f2d97bb

SHA1
2d56b5244ad233e1c9ca727b502d5c54976ba431

SHA256
dc01fa5ca5c750c8c9ac807ae10cafb6edc3ded266d116dbf488c5bd67ee96cd

SHA512
630a7931f7bf23f27580c87dbd9093e78e26a322e708faca6dd79778640e624f7816c84114be28017fb26f53f49a56bba42ecfa96be06b901d6e24a087a4ecc6

Download Submit
C:\Riot Games\Riot Client\UX\locales\am.pak

Filesize
307KB

MD5
3e292ba6a915ec8b8f2408e71c03425f

SHA1
c8f4ae13011061239fbcb837d2e2f84a9e876e3e

SHA256
ff9412b525b65672142841dbef0f334279b5302cd9712710bdc7143584f8b502

SHA512
8a5f4531fe7aed67cd146fb53772fd5a3fae9aa24eb4f58ddcda5ac56fc6fa22fa8fbb824faf8abac992c5c0d24446593dd05ffe106d2c29fbba0fb5a095c5ed

Download Submit
C:\Riot Games\Riot Client\UX\locales\ar.pak

Filesize
307KB

MD5
7f1598c653aaa2879ecc1cc20cd9f515

SHA1
10a2d8a72e0986962f6ad544ea1c6042fceef402

SHA256
a41ab9fc62228f7670ee4671d1b076db59b07663a60519559207d22c4cdd4a04

SHA512
fddf3976e8263df6ac128be43393f42b3c7c8d114381512752e5845bed0b538717a63cde33a8fb2649568d34cbdaad7a7a5049f60d35c1f072936294c07a76f6

Download Submit
C:\Riot Games\Riot Client\UX\locales\bg.pak

Filesize
353KB

MD5
60c21da051795a1cf427d51ff7b8084f

SHA1
08f2469e42d76d7cbe03c674fde9734e46c45f52

SHA256
de8e1013cfc781d981f2a06abe714a5a45d76b0e7f55f137ea7785b26e391a8c

SHA512
5100a4721b53795b97c5e7f3e2179335e103a0c32890ffd4eef2468a9e868da781b366f9ea3f872f2a96293340135d0f79e55dc84cc8dac36528fbfe969f13de

Download Submit
C:\Riot Games\Riot Client\UX\locales\bn.pak

Filesize
456KB

MD5
f4018fb82d1baeed446f6da78836c2db

SHA1
4c86394f38f791c98f5c673f245e71a5da6b13c0

SHA256
47d52469f70d3b2dfcd2833dc76780c7c9fe493ff2a1e3b962a22f1ef6739d73

SHA512
ab3e6f0db18ab2760d0d673c4e39ff9d173b6df134188a7e528942b027176d79582215d5f75c3da63e1555c6832b05d7a9e901668d34c6b05bce8552696018e2

Download Submit
C:\Riot Games\Riot Client\UX\locales\ca.pak

Filesize
219KB

MD5
77f47ce82e5bfc2200c7abb88b267123

SHA1
088c5d7137e70687f78b3252db7134a6c219334c

SHA256
b3b2f1af10ce9290a4c5a6c7a4799643a91b0a020771ba6715ba2b7e90f9b79b

SHA512
61605a0e99d0cb5aaa0e94143a212efc71aaf7ecc92ba48c6b6b767e2cfbaf0910b9a94b8941d07a6db14ee41d97ad3a57b3b219fc8d02b75af8a180ecd3d15a

Download Submit
C:\Riot Games\Riot Client\UX\locales\cs.pak

Filesize
222KB

MD5
469e61806b2ab8ffb9155a03896c8302

SHA1
0ec06aa7fcfeadb9390e284f06164a12e44451fd

SHA256
111e13702813038d6359a912b2ca544a1f93f0ea141e71bd97a57a968aa3cb72

SHA512
6fe7edbba42198f5253cf1dd3ce077c0ac2b8118d3e00727991dbe70c6be4abf34db3d2aa9595876b09f03d4f639bf431ffacf5ae57f4c8167ec59db979523f0

Download Submit
C:\Riot Games\Riot Client\UX\locales\da.pak

Filesize
199KB

MD5
6c623ae0860ccc782fc004667c78ee78

SHA1
77b4f676c50758ad040777f608b3d7f26cad466e

SHA256
ee304be73b9e06bc2b01aa76266d88bd0b24d8f3ed1fd28e61e165bbcd4c03fe

SHA512
c4efc7568a8ad9392ca4255745e5ee1603171fd14fa4ae054b6794b3bae32846f9c3df8f200f9e8fd62dd72a72d841f9537054a3d079842ae416af1a644462a1

Download Submit
C:\Riot Games\Riot Client\UX\locales\de.pak

Filesize
217KB

MD5
0e3b31f511b316bfd87c92c5550f1cb7

SHA1
4d84cd949704adae1b26481c8f8023de96ff88a6

SHA256
f79f058578bb810c135d34e5b1285299d18cd24f333397997354ad512b6e2667

SHA512
8ef155f67f9d6f2d9a7c7d2293e0f1cdee7943b3cad9c39620b5628deca008d6b86211cda2132df68ae9c4615837c9096628a857c0ec9f10e91e35480b14dae9

Download Submit
C:\Riot Games\Riot Client\UX\locales\el.pak

Filesize
387KB

MD5
7d54147bd7ce0e3289cd2c68ef3395a9

SHA1
a6ad275cecaca42ecf86c9a21404bb32f2cc5b54

SHA256
5384aadd68f14a95260e4364efe1b46e7d6ba60d47a298b2fe92f71705f754e8

SHA512
657e11b9616ce37a4a8c2e0a9aae056e9e6cbfe2b42dbb50ad173600fa65eb4f9b419620963cf4b952588bfefee24f5fa56dde67a8a322715f7b321cf27d35cb

Download Submit
C:\Riot Games\Riot Client\UX\locales\en-GB.pak

Filesize
179KB

MD5
e06bee2c069738c1761b1f07a5a65c3e

SHA1
06a392f1c7b2081ceed5e498dbce5fa76955350c

SHA256
0969f4a50fac5f7f6d5040f3f0ca1016de578151d1633780fe7d8e3daa8c29ec

SHA512
02faee2b47588b27a82b1c98b8096f3f25a219d3e7cad11c7eeaf3bd3fb20fe51ce8db37d4148eabd7891c02e7f4f8c6a8612355c9dee2d0dd117f553ef6cae3

Download Submit
C:\Riot Games\Riot Client\UX\locales\en-US.pak

Filesize
180KB

MD5
dc99f78630d32819ebce696dafd26579

SHA1
34e9f3f8be6fba7e0c586cec4aa203422efe281e

SHA256
3e3d563b035609fb2e0dbc9cce32c23fceb4e69db36b9d49ef355515b425ba93

SHA512
460f6a965534f99bc5c5e294bd7571b0e4291bcd226da0c808eb4181984f279edea0325d1816c3d654b78cbd05fb3a5e233c0fb5bb8dfdbcd010ed17f6b4de9f

Download Submit
C:\Riot Games\Riot Client\UX\locales\es-419.pak

Filesize
215KB

MD5
3b0dbd76f824d646f684a1eb7782bb60

SHA1
1446a0f18ceb493cfc6e18ab6a08b51e6d6aa596

SHA256
307994b5e793c569606a14208bcba658ff5f1ff8fe92e3a16b3f05e2cfbbf3ee

SHA512
cd5062e39eff21e8a0e15ff2c3d2e531a2be569ff22adb3c596044e3b4663c6df35a9513a8d98b5fe927fbc029eb89d9c3806a32a4c10fdc5ddcbd161d3c55e9

Download Submit
C:\Riot Games\Riot Client\UX\locales\es.pak

Filesize
218KB

MD5
d546d7722a37ba055ab8a33b682b8a19

SHA1
9d8939dacfeb9830d46efbe94e84f476337198d4

SHA256
2fb12f93c3811e8c4f1a01472f1f0b4992f7a11889a3f64ed73e867f30bba46d

SHA512
1f3d830308fe94cb4fa5ff02f9b83790a723f46024222ea7128aaa7f7d77e0a59f2cb6a7f8888a34810560d46d647ee677ee6668a00328cd9c9f83a31da6570a

Download Submit
C:\Riot Games\Riot Client\UX\locales\et.pak

Filesize
195KB

MD5
468578bb57b0616b1fef43167cec075c

SHA1
6858327c4fbf47b87b14a48cde7f307ba0bdef36

SHA256
0244e018424f65654f6181a022ad20d96365c0eb90676dff01214eeec24d40f6

SHA512
88b116f7d33cd79916a405e4689bda2b9d89f803704e8cafe0475fee28532d30900b3aa0c5459d1dd79e224682894f6eb70beff7b4fcee68a3d39003180af803

Download Submit
C:\Riot Games\Riot Client\UX\locales\fa.pak

Filesize
310KB

MD5
74cb66f8ed8c4e708a687f8b6e018abc

SHA1
0f577813cb11ff371057fd5aa027ceb5d51645d8

SHA256
abe333527dc0a9fd5f8b4e534db191ef74f4e9f015a40d49fc36bc71895af66c

SHA512
dacdc6f395ad395740ce9782253d2e20b2715789833960ba0647f6b4bc005e171b58966f510ed22f1421e32bd46286cced796d3d150859c64657b340082ddfee

Download Submit
C:\Riot Games\Riot Client\UX\locales\fi.pak

Filesize
201KB

MD5
a86418f62294a4db2d45b1dd662300ab

SHA1
007552b7890ab9ab3ab59c5de53c4fa6b2c2f757

SHA256
fda77c3c1a4d658e3d5db8940f68bad017dd79fe30e8430a2c1eada2d7a504b2

SHA512
e1dc0edd017fd7554a93fe945b687a6bcf96d4d5516a23f85a665093f8b7721b279446738833384735255a4e5e4ff98d2bca2b5c7008e509372693d20b286b58

Download Submit
C:\Riot Games\Riot Client\UX\locales\fil.pak

Filesize
221KB

MD5
e9e9b5738dcc5c64c0564ebee8cb3f48

SHA1
b1368226185f02511862f0795acfcf9070a555c8

SHA256
f74e56617241f9e6db3aba7cdf0e2442f9b048437ceef7bd401f50f9639eb30d

SHA512
e7d8c13c4932bc7ca5ded567dbe19184ab199a556635a1f94f67948ac4e3ad57b4ea0d658074850b00bbc1574609ad486658a753f344c8b16c372fe53bced47e

Download Submit
C:\Riot Games\Riot Client\UX\locales\fr.pak

Filesize
234KB

MD5
2352a2bb3481eea03c76a67b8677918e

SHA1
03644bd352b256980e9045e20964733d969b877a

SHA256
11857a275941715d519cefac3105e906fb97777b712d095844c5f8666dc36c6b

SHA512
17f2cbdec9775e4bb52360e76a1a5aaac9d9a2e616d115d5b84f42e86e9db1a9ebb48f02e1e3e9af8183707b9a7e85595f36a85c0612cfad9ee4ed280c320e9a

Download Submit
C:\Riot Games\Riot Client\UX\locales\gu.pak

Filesize
433KB

MD5
79886060308ca116d2e8916e1682b828

SHA1
dddea4d8e41d1cccccbcf47d93ae7327e5f27f81

SHA256
d67b61f99067479b2492aae7f204ea0b1ce54359a21dbd685202fbf22503fa89

SHA512
41f813711f46800a9dbaa3650aad99d1e9797ae8a8bf44eb432d47856b0fe3989641a81a799f196d577497b952cd938e667b62fa7c85cc89ef08ab02b705ed80

Download Submit
C:\Riot Games\Riot Client\UX\locales\he.pak

Filesize
262KB

MD5
64e7fdcd09abd5e14521f6e49fd2436a

SHA1
db8d47bb41e4dabbd5bf09154a22b4b97d727c60

SHA256
cdd6702ffd3f9f96650e38a29b7f4105d50cabe6ec13c68c276aa85b9c36cf5e

SHA512
e13a96e7b0169258f2e88a93e33bb828bcff69ef3bd563743c8a7e05a74a541b594b913f33ffa972f4ae8e20338340603d6d381a73867cb9525de314aa638a70

Download Submit
C:\Riot Games\Riot Client\UX\locales\hi.pak

Filesize
445KB

MD5
e9a7bc6dfa4016bda1a4faadd0a96086

SHA1
c8a34f234ddbef70e289f86e261383d605e44042

SHA256
af7c37edd3eafbce6698e270070cfa55b3975d0d87d2336ab09626a9ffa458e4

SHA512
ddacf9d5cf2adbc5a008584816a3fdc77dd824cdf83b65cd002f4e3415bebc017f3998d80d9743badafcff5950181ed03b5f75d0bffffdd949f9812eb961bf19

Download Submit
C:\Riot Games\Riot Client\UX\locales\hr.pak

Filesize
211KB

MD5
dbb5a619e31e3958b7ee5df2e68a44da

SHA1
a4dc7b9c7a6e2b9c7388a9214a31bd474bc85427

SHA256
728fdadf1773de85598edcda70bf7f88a9a46c67de01433cec39b2ff77ff5605

SHA512
68141e5ec9263e7e85122b9be0c1088c23f752e98f5147b59a2bbad4fdf6936d9a4bf93439a78723a15f0b7c0ae878914c625618fcd2d28a0fe0cfb7f809da37

Download Submit
C:\Riot Games\Riot Client\UX\locales\hu.pak

Filesize
230KB

MD5
83f2bff36db68815963734c6f14d2cea

SHA1
f331a6f077191f98e83eb228bde5db7f199a028d

SHA256
db0dd153fabcec2e31d652807226d5ffbd7c26231adb0aa5602157500c7e07b8

SHA512
dfa645f7d94ee691be6bfc4725acb5e70f8ad14b952c614d2477f23aeea7bf2ba8b2ed08e202a8ce52d75b1741c98e66a8393e0a3de83158ad16e879c6bcffa3

Download Submit
C:\Riot Games\Riot Client\UX\locales\id.pak

Filesize
193KB

MD5
eff880916f5f7ca92fef688128e7b2f2

SHA1
a4bd046d14dc5135731e962e9e0fb02d84161bb0

SHA256
f9c3b84bde54646db226261e2a97c491a2b29a2de96edb7825f05aafeb9a0894

SHA512
aeabc3b258dd5c47f76707adc105d19cc1471400099ca2db29de491f79ee4729173d5ebce63ec19604dd2c87cc2a39213d0b39b294d100a98a007b26fadd50f9

Download Submit
C:\Riot Games\Riot Client\UX\locales\it.pak

Filesize
211KB

MD5
b1af2ee608bce8b124401f0f1a8e1719

SHA1
264658a45c142e9b429d0cc578247dcffffdb612

SHA256
33ee8f8134b149aad248567fe8e5b220704f7422fc05aa1c9de72b836c74d52e

SHA512
392b3e416812ccb0628ff54488a46152f7f9c4125570a65e967d35ebac775cdbea3827b5144837f4ca18ed7872faef669848919201921404d9eedcdd75445a6c

Download Submit
C:\Riot Games\Riot Client\UX\locales\ja.pak

Filesize
262KB

MD5
fb94a46c081766f72924c0234fcb53da

SHA1
73fcf750bb3e9603dd7794e5ace42c82988eb9e7

SHA256
851f8817e1f85edd320cfab4b560e8b468ce4c53bb739e8afa14997c84f58eec

SHA512
fcfae2e9ab0732139b2c6a9431ad272e76a3123e0f924da6e9d29bf0b1a4321ccb83d3b1941d182f755b081c8d1f0037505ea2bbeb91259953a1cbe327b6db1f

Download Submit
C:\Riot Games\Riot Client\UX\locales\kn.pak

Filesize
505KB

MD5
a125f1889817658c5c2687ee8f9f321d

SHA1
e35b08389a40dbde5e03a963f89393d645f8352f

SHA256
bd3a3e1cad20c2681f3b2e0c3c0425cd023d6c116b4bde5692ebcb54c64b25cb

SHA512
6b39f061b1611914c59093b090f6139037083f3029545cdbc54ab96b478433e52a7f05fcde618102fa2e5711bea6fdbcd6f12a98d98ae70a8179f4068050a78f

Download Submit
C:\Riot Games\Riot Client\UX\locales\ko.pak

Filesize
220KB

MD5
a25bcd561eb7da40b12e4670d751d8e4

SHA1
a2d08f3185307d9f589ccd408e97386f213bbe47

SHA256
ae0a82ba25b8de9cc46576ae22a23d2b42d44d80d885fad801be3c86f4a5a23d

SHA512
9c8fa113a1b70d51b41c525cb85fa9449b136c2f685e33ec34b581597a90dfe2c166304f0c66f5c14c8d6a5079584fb19a06f68dfb8c0c5e21b4695aaf5d7122

Download Submit
C:\Riot Games\Riot Client\UX\locales\lt.pak

Filesize
226KB

MD5
c2245554244523776eca368a82983ee6

SHA1
90a51f9ddfc39cf46a4bb40163142e87dc27305d

SHA256
e4bc73b72e21433ac030792508b5c035a691d98a54e1ea9da6374eaf10136674

SHA512
f73a8a5904b7ec450c06341f89938c38ef296eeaf2c19ca50be84af3ed36cc35e8573c83c717ce761d9b85ddc824091c4d5c775fe937a2d3050fcc01c874732d

Download Submit
C:\Riot Games\Riot Client\UX\locales\lv.pak

Filesize
225KB

MD5
a95048f767306a131b876df74cf55348

SHA1
3067ed001a6380c65479ef0fecd02d1161a0d5d9

SHA256
1d99df3b2e361dff299af3536eb878407779ce881f6d94079518bf887795d794

SHA512
f1854324b83e74de089a224e74e5ccfed45ed2abba66b0232c5019318f7b56bffba14647b7f102bd5052a0ddcec3259bb9df67eead04bc1811e144edb305f01c

Download Submit
C:\Riot Games\Riot Client\UX\locales\ml.pak

Filesize
543KB

MD5
3ebdfd0ab9999b5ad515eb052dfdc577

SHA1
f4573147e170409dfa1551393f87f396d1e02d3b

SHA256
cdfb4b55f697311ba2e81bce89c9e4f1e1592d54d9bbeed23122013a3fa2f8e3

SHA512
d35b186f0c7e225a27a081df288efbce988c449510613e5955df7bda45905b76b97a7864a250c60ca5c5796963da413194c697cbb074689c7e1f441e1f98c85b

Download Submit
C:\Riot Games\Riot Client\UX\locales\mr.pak

Filesize
440KB

MD5
f242e8272db35e1174b498bbb0aa4949

SHA1
fe40c221cafc6c234f7be145f17261812e260e3e

SHA256
6f863f60ab41b9803333d576300d82790d4f52be4c6994e56d5733f167310e4c

SHA512
4d5bc907974a5a0df435aa69ba32a3ffd98634340278194e8a0af7ac5e1be0feffb6b07a4190c2fa7cb81e9518cdb02a995879d88465ffa0d9547cb98bd84bc3

Download Submit
C:\Riot Games\Riot Client\UX\locales\ms.pak

Filesize
200KB

MD5
c8a712e9cbd091697903a118f8e4afe3

SHA1
c6e46af7ba006c96c92312228b294066eb800e96

SHA256
4bea0031a0115923bac10aebe42fb0dcf4a49f54e28a8ee30edadfd1af1a7262

SHA512
d20d630a5bc217e692f208dd4479c437797249db4c87711098d4bb97b57b3e1bb816a230f84ebf01fa6fca2240352dcc28d1173f5d418a94801b3eef98177051

Download Submit
C:\Riot Games\Riot Client\UX\locales\nb.pak

Filesize
197KB

MD5
d25fafbf9671d948c510f4fedd257703

SHA1
695cbf02a8649012cfece3aa7953a2415792bb05

SHA256
a59966ae8e08a47491d2dcbb35b4ff2e149064d28794496566991ddede4d50de

SHA512
4e8875770975b3e13d255f392a34e709e798cce5ae6a9fe97898cb980e4246c159cd426a60b67260a160b63951967e77c38ab32a85c649b067ba48543c74fb61

Download Submit
C:\Riot Games\Riot Client\UX\locales\nl.pak

Filesize
206KB

MD5
34bb7a19b695fc9cd97e3bfe644a6bb0

SHA1
7ee6f12579417783f42915ba45dd46c3554c8584

SHA256
93196be4f6b6b055cf8cdcd715e04db564644657b5c73a84aca9bcaa5c89f3bb

SHA512
ffb689d62d79ad0b1fadcd6b0e428a636c0288b939cb6f58405ed366f019d8f5d16032b46f0f9e05a66c3241d4ad71b150a1a99a2ad0c18a6c6de5c9ae8ffbf9

Download Submit
C:\Riot Games\Riot Client\UX\locales\pl.pak

Filesize
219KB

MD5
92a70e7431a2d76f54070f86f99bcdfd

SHA1
e4f4d94a77104902e859b4d0c99cefb85b29afb6

SHA256
da0dd276248e46c375a09a308a266f8708917b5ba6fbb0ee245fbb988ebab785

SHA512
b595026998417a12579a13e6b1f6b510f364019ad0c84a94fdbe065fbef07307683f0ad3ff6eac6dd1c8cd22ecfe4f83c8db4808a5ecb66a58d4cf782aaa2ad9

Download Submit
C:\Riot Games\Riot Client\UX\locales\pt-BR.pak

Filesize
212KB

MD5
f2d645cd25559f8ade54d1372f864294

SHA1
399d0433975ccfdbe1da399ba1f742163583812d

SHA256
a2ed13735176895507e6600718a7f2a13689c246950d1d807b1b1f16d64af2d4

SHA512
7a22f3667ee8b4647d0d0478855609a19f485d71718c93e0e709ab58a286974196389d3705c322c44ec8183ee9045c85186288f6e3645a523443bb9ff34fe0e9

Download Submit
C:\Riot Games\Riot Client\UX\locales\pt-PT.pak

Filesize
214KB

MD5
8b0bd3c98add6936eb5739c025a87c5f

SHA1
4a8c91da0a65d097523680a441150238f865cd42

SHA256
369fb57c64066aac72ab8a5ea44cfe87e83a25a0a9b8c66299d4d372e637c46d

SHA512
75b7461be36d2976d7ba9ee51d4296f58792232a52cc96974ce6b5f5e27c9fdcbd9fd0fffebecd381b722b5b15efa310d6cd7f0369c50602433182bf8e143a17

Download Submit
C:\Riot Games\Riot Client\UX\locales\ro.pak

Filesize
220KB

MD5
657288dc93e6afeeec4e561ef672cff8

SHA1
ff3e00c80f6436e257dc36074de88198ec1f2abe

SHA256
d4fc7478164a2c9cd60305f75be644b1f7b80ef8b14cd4a1c34fec2e9434eb81

SHA512
63cae8feebd0f15313542a888d854429a1b97586628da9be4997417172ef60aa5acf64bc24fc5e1cf1ef09734a82f09f0efe014d5ee05960a4a209cbdc5845e0

Download Submit
C:\Riot Games\Riot Client\UX\locales\ru.pak

Filesize
341KB

MD5
5ef23ee12e24e62ae4fe9e722b689259

SHA1
5634dc4402d120a9dc293f2813fc62a9ce86abe6

SHA256
6f50ad5d217d719994c9501b75cba3aa86e6970851854232fdb95d9261685371

SHA512
db59c80278d06358663b8d95d7140e287c20451db16820bc4de96b9708deae055a7862bc53c0ec90c6d346637b897addd16267258f93bbab1403277612458561

Download Submit
C:\Riot Games\Riot Client\UX\locales\sk.pak

Filesize
225KB

MD5
4ccd61ea569cd6f9b8eaa0369c2ce65a

SHA1
ae5296bdfce1d4b057a240ea6cc56e8c09f0f73c

SHA256
e059f6fe26dec24db0669589dad5da8950e70fae435af4f0a042e62c676c0b5e

SHA512
666e8dec81adbe65143b496369dc9138e00f588e0a1e9dc18e1aa44154eb4b6e8d51953323e036bd6ca95de04b86d863d3a7e8dc5325f823ad0ab652b0d375e9

Download Submit
C:\Riot Games\Riot Client\UX\locales\sl.pak

Filesize
212KB

MD5
e63debb39b36c53f318bed0f2596c47b

SHA1
1dc350c9d19f73b6b8167e5d659975e43309cb01

SHA256
2a758503df99441df673212cfbc9cf15f6b5dd459346264dda98edb09d609946

SHA512
2455285cb96e883b6d599b55ace36a53b8aa43ecd731e813598e028b85ddc96c705009284d9343b14d1bcbda17560f33a2ebf8b5ece8c90c995303b1fdb5a5cd

Download Submit
C:\Riot Games\Riot Client\UX\locales\sr.pak

Filesize
330KB

MD5
7dd73adf36b7079aa327a6bd1ee7b6d1

SHA1
c2a021e9f3366e24555cc33f8ac2672866490bd4

SHA256
77d9d4e89a645f9129cce7dc2a354cf2bc8cf33ea33db366fc5dd7b687664f98

SHA512
4b462320c2fe748d7d82ddcba6740bba4dab92941629c270680d51154167668e2399d93bb960d0446a519badacc22650a32ba81088d974f509d9c303b48715a9

Download Submit
C:\Riot Games\Riot Client\UX\locales\sv.pak

Filesize
198KB

MD5
c4f1eb7fb44af1b85a13e879bf61cd10

SHA1
9890fae1b62ce2e015980fe14257ce4620ba1565

SHA256
474bda32df40405acce873face0f49804f3ff8719fd8d459312a23a5c82c97a5

SHA512
171d2ab10d2e980a0d4cceed46ee6f985baeb2eae127e00882d01ae06b7bac6a7e9079b71113d19fbbcce94d0e794df6c89e80613cf8379a2cc5025e4b8bed0b

Download Submit
C:\Riot Games\Riot Client\system.yaml

Filesize
16KB

MD5
050fc31c8fcddaed084965562f5dc2b8

SHA1
285a02a573c9359c77b4c8f9e127d331a289c091

SHA256
4f073ca28aacc0bc59b6cf2dd2ec3aa091af803f53174a5d7fcff75f2e9c9edb

SHA512
013b9a32a5f3406a54ddf766e741dbb20619a800a3adb02fb31245830add87f56e0dd5f33e683b373260ff8c217c97bcb7e650c2506243121e7f19e42c0bd695

Download Submit
C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\200f535a-6f6a-44c2-840c-c90926a7278e.run\__sentry-event

Filesize
462B

MD5
d323c2b75879851b3a51aa06166dc2a1

SHA1
1ad77d003bb4b8bd5a7b2bc74288fbd70d76ca69

SHA256
43dd65e2c04bf6c4047cafaf01c36a6f17812af968491816a0bee15a65edc245

SHA512
67e5e55eccb4ff99797330a929b3c936482e7ee9136c8405ebbf8ef513a6c3615475f204d375716934e42df5003a60c0d5da48967013b3c16f1215dfb5249c39

Download Submit
C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\RiotClientUx\65ffde60-f4fb-4866-ba8d-e3ec13870708.run\__sentry-event

Filesize
464B

MD5
9f0a3c36940d0e76a8a7a03296c04b3b

SHA1
7532d640693bba714e71c422abe1b0aed7d16f23

SHA256
870aace666a27fb3982530750c451bf653bb3fb482374dea4ed11fb9d9fc57f8

SHA512
7480df16bac09b41995a7cf108a2667f8eb088158e3813ba2e0194b01c6f95432caaf761ad52bcf619a288d678db8c8767b202bf8eafbec8244afdc3a966c05b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DXSETUP.exe

Filesize
505KB

MD5
bf3f290275c21bdd3951955c9c3cf32c

SHA1
9fd00f3bb8a870112dae464f555fcd5e7f9200c0

SHA256
8f47d7121ef6532ad9ad9901e44e237f5c30448b752028c58a9d19521414e40d

SHA512
d2c354ee8b6977d01f23c6d2bb4977812bf653eae25e7a75a7d0a36b588c89fcdbdc2a8087c24d6ff687afebd086d4b7d0c92203ce39691b21dab71eafd1d249

Download Submit
C:\Windows\Logs\DirectX.log

Filesize
474B

MD5
a104ec9b3b982cde7f5591d2f0780978

SHA1
bb2cd3afe43b6f68146a654cc9237fcd041fa824

SHA256
42f7580dfc380c26d68d2e98f5d51cb7daa58bef1dae988888ca9f6e4a72b932

SHA512
e55196bb5476ec841853aafc897bebe6f1caff7e8a6f4824ea0309797caccf1dd5cacafd8fe94d640e7392a5527ac71c7aaa841f40ec3727ef753d29a6d5d9e5

Download Submit
memory/3828-356-0x0000000007ED0000-0x0000000007ED1000-memory.dmp

Filesize
4KB

Download
memory/3828-351-0x0000000071EA0000-0x00000000723A7000-memory.dmp

Filesize
5.0MB

Download
memory/5276-687-0x00007FF659510000-0x00007FF65AABA000-memory.dmp

Filesize
21.7MB

Download
memory/5920-572-0x00007FFD7EA70000-0x00007FFD7EF1E000-memory.dmp

Filesize
4.7MB

Download
memory/5920-660-0x00007FFD9E340000-0x00007FFD9E341000-memory.dmp

Filesize
4KB

Download