ac9ac5a95273064ba09af8be049124ba52db7a59075d69a94d12427917dbc376

Analysis

max time kernel
139s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20231129-en
resource tags

arch:x64arch:x86image:win11-20231129-enlocale:en-usos:windows11-21h2-x64system
submitted
02-12-2023 04:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gameguard_setup.msi
Size

7.7MB
MD5

68bd8f9af44479db013a77c806f1c674
SHA1

0cbb2b63c78b42e13b1818964bb2cf43e46c5052
SHA256

ac9ac5a95273064ba09af8be049124ba52db7a59075d69a94d12427917dbc376
SHA512

991f703293b984beeeda44cc72cacc0cd69bd4cb1856b2b1c5cf2a2d06d7f58e8469af70c2ecece05d98643937c52f8a944b9892e2925738457d2ac238867852
SSDEEP

196608:mELpCPNYnYCCJLuMo3nmkmKf+GNI1Xjn5CD9ilxw:fLpCVY7CtuMo2kmcNmsiLw

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

Processes:

gguard.exegguard.exe

description ioc process

File created C:\Windows\system32\drivers\acdrv.sys gguard.exe
File created C:\Windows\system32\drivers\acdrv.sys gguard.exe
Executes dropped EXE 8 IoCs

Processes:

acsvc.exegameguard.exeacsvc.exeacsvc.exegameguard.exegguard.exegameguard.exegguard.exe

pid process

2932 acsvc.exe
3080 gameguard.exe
2040 acsvc.exe
5056 acsvc.exe
1712 gameguard.exe
4168 gguard.exe
4500 gameguard.exe
2628 gguard.exe
Loads dropped DLL 3 IoCs

Processes:

MsiExec.exegguard.exegguard.exe

pid process

672 MsiExec.exe
4168 gguard.exe
2628 gguard.exe
Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

3 3184 msiexec.exe

description	ioc	process
File created	C:\Windows\system32\drivers\acdrv.sys	gguard.exe
File created	C:\Windows\system32\drivers\acdrv.sys	gguard.exe

pid	process
2932	acsvc.exe
3080	gameguard.exe
2040	acsvc.exe
5056	acsvc.exe
1712	gameguard.exe
4168	gguard.exe
4500	gameguard.exe
2628	gguard.exe

pid	process
672	MsiExec.exe
4168	gguard.exe
2628	gguard.exe

flow	pid	process
3	3184	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

Processes:

gameguard.exegameguard.exegguard.exegameguard.exegguard.exe

pid	process
3080	gameguard.exe
3080	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
4168	gguard.exe
4168	gguard.exe
4500	gameguard.exe
4500	gameguard.exe
2628	gguard.exe
2628	gguard.exe

Drops file in Program Files directory 19 IoCs

Processes:

msiexec.exegameguard.exegameguard.exegameguard.exeacsvc.exe

description	ioc	process
File created	C:\Program Files (x86)\GameGuard\acsvc.exe	msiexec.exe
File created	C:\Program Files (x86)\GameGuard\cache\jgvrxrf.cache	gameguard.exe
File created	C:\Program Files (x86)\GameGuard\steam_appid.txt	gameguard.exe
File created	C:\Program Files (x86)\GameGuard\steam_api.dll	gameguard.exe
File created	C:\Program Files (x86)\GameGuard\steam_appid.txt	gameguard.exe
File created	C:\Program Files (x86)\GameGuard\launcher_x64	gameguard.exe
File created	C:\Program Files (x86)\GameGuard\cache\chrorweq.cache	gameguard.exe
File opened for modification	C:\Program Files (x86)\GameGuard\acsvc.exe	gameguard.exe
File opened for modification	C:\Program Files (x86)\GameGuard\gameguard.exe	acsvc.exe
File created	C:\Program Files (x86)\GameGuard\cache\sujcmfbx.cache	gameguard.exe
File created	C:\Program Files (x86)\GameGuard\gguard.exe	gameguard.exe
File created	C:\Program Files (x86)\GameGuard\acsvc.exe	gameguard.exe
File created	C:\Program Files (x86)\GameGuard\cache\pdvnovtq.cache	gameguard.exe
File created	C:\Program Files (x86)\GameGuard\gameguard.exe	acsvc.exe
File created	C:\Program Files (x86)\GameGuard\gguard.exe	gameguard.exe
File created	C:\Program Files (x86)\GameGuard\gameguard.exe	msiexec.exe
File created	C:\Program Files (x86)\GameGuard\cache\mrcaospw.cache	gameguard.exe
File created	C:\Program Files (x86)\GameGuard\steam_api.dll	gameguard.exe
File created	C:\Program Files (x86)\GameGuard\launcher_x64	gameguard.exe

Drops file in Windows directory 14 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\e57e426.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF02481A0616A18E19.TMP	msiexec.exe
File created	C:\Windows\Installer\e57e428.msi	msiexec.exe
File created	C:\Windows\Installer\e57e426.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DB58A440-02BB-433B-AE99-D0B8AF31A839}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF280B4B813A250E8E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF45A4AFF9A63F6D29.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE704.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{DB58A440-02BB-433B-AE99-D0B8AF31A839}\icon.ico	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{DB58A440-02BB-433B-AE99-D0B8AF31A839}\icon.ico	msiexec.exe
File created	C:\Windows\SystemTemp\~DF56916F47D529E844.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000008a981521f0dcd74c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800008a9815210000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809008a981521000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d8a981521000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000008a98152100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe

Modifies registry class 46 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\044A85BDBB20B334EA990D8BFA138A93\DesktopShortcutFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\ProductName = "GameGuard"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\14D8C6FEA992C334C8E1F1E30B83F8E1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gameguard\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ggac\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ggac\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gameguard	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ggac\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\PackageCode = "FCF74D9E87639FE42A3F49F0B413967A"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gameguard\shell\open\command\ = "\"C:\\Program Files (x86)\\GameGuard\\\\gameguard.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ggac\ = "URL:GameGuard Protocol"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ggac\shell\open\command\ = "\"C:\\Program Files (x86)\\GameGuard\\\\gameguard.exe\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gameguard\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\gameguard\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\gameguard\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\ProductIcon = "C:\\Windows\\Installer\\{DB58A440-02BB-433B-AE99-D0B8AF31A839}\\icon.ico"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ggac\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\044A85BDBB20B334EA990D8BFA138A93\ProductFeature	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\gameguard	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gameguard\ = "URL:GameGuard Protocol"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ggac	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ggac	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\044A85BDBB20B334EA990D8BFA138A93	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\SourceList\PackageName = "gameguard_setup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gameguard\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ggac\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\Version = "16777216"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ggac\DefaultIcon\ = "C:\\Program Files (x86)\\GameGuard\\\\gameguard.exe,1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\14D8C6FEA992C334C8E1F1E30B83F8E1\044A85BDBB20B334EA990D8BFA138A93	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gameguard\DefaultIcon\ = "C:\\Program Files (x86)\\GameGuard\\\\gameguard.exe,1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gameguard\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ggac\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exegameguard.exegameguard.exegguard.exe

pid	process
3184	msiexec.exe
3184	msiexec.exe
3080	gameguard.exe
3080	gameguard.exe
3080	gameguard.exe
3080	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
4168	gguard.exe
4168	gguard.exe
4168	gguard.exe
4168	gguard.exe
4168	gguard.exe
4168	gguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe
1712	gameguard.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

660
660
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

544 msedge.exe
544 msedge.exe
544 msedge.exe
544 msedge.exe
544 msedge.exe
544 msedge.exe
544 msedge.exe

pid	process
660
660

pid	process
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exe

description	pid	process
Token: SeShutdownPrivilege	1596	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1596	msiexec.exe
Token: SeSecurityPrivilege	3184	msiexec.exe
Token: SeCreateTokenPrivilege	1596	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1596	msiexec.exe
Token: SeLockMemoryPrivilege	1596	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1596	msiexec.exe
Token: SeMachineAccountPrivilege	1596	msiexec.exe
Token: SeTcbPrivilege	1596	msiexec.exe
Token: SeSecurityPrivilege	1596	msiexec.exe
Token: SeTakeOwnershipPrivilege	1596	msiexec.exe
Token: SeLoadDriverPrivilege	1596	msiexec.exe
Token: SeSystemProfilePrivilege	1596	msiexec.exe
Token: SeSystemtimePrivilege	1596	msiexec.exe
Token: SeProfSingleProcessPrivilege	1596	msiexec.exe
Token: SeIncBasePriorityPrivilege	1596	msiexec.exe
Token: SeCreatePagefilePrivilege	1596	msiexec.exe
Token: SeCreatePermanentPrivilege	1596	msiexec.exe
Token: SeBackupPrivilege	1596	msiexec.exe
Token: SeRestorePrivilege	1596	msiexec.exe
Token: SeShutdownPrivilege	1596	msiexec.exe
Token: SeDebugPrivilege	1596	msiexec.exe
Token: SeAuditPrivilege	1596	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1596	msiexec.exe
Token: SeChangeNotifyPrivilege	1596	msiexec.exe
Token: SeRemoteShutdownPrivilege	1596	msiexec.exe
Token: SeUndockPrivilege	1596	msiexec.exe
Token: SeSyncAgentPrivilege	1596	msiexec.exe
Token: SeEnableDelegationPrivilege	1596	msiexec.exe
Token: SeManageVolumePrivilege	1596	msiexec.exe
Token: SeImpersonatePrivilege	1596	msiexec.exe
Token: SeCreateGlobalPrivilege	1596	msiexec.exe
Token: SeBackupPrivilege	3172	vssvc.exe
Token: SeRestorePrivilege	3172	vssvc.exe
Token: SeAuditPrivilege	3172	vssvc.exe
Token: SeBackupPrivilege	3184	msiexec.exe
Token: SeRestorePrivilege	3184	msiexec.exe
Token: SeRestorePrivilege	3184	msiexec.exe
Token: SeTakeOwnershipPrivilege	3184	msiexec.exe
Token: SeRestorePrivilege	3184	msiexec.exe
Token: SeTakeOwnershipPrivilege	3184	msiexec.exe
Token: SeRestorePrivilege	3184	msiexec.exe
Token: SeTakeOwnershipPrivilege	3184	msiexec.exe
Token: SeRestorePrivilege	3184	msiexec.exe
Token: SeTakeOwnershipPrivilege	3184	msiexec.exe
Token: SeRestorePrivilege	3184	msiexec.exe
Token: SeTakeOwnershipPrivilege	3184	msiexec.exe
Token: SeRestorePrivilege	3184	msiexec.exe
Token: SeTakeOwnershipPrivilege	3184	msiexec.exe
Token: SeRestorePrivilege	3184	msiexec.exe
Token: SeTakeOwnershipPrivilege	3184	msiexec.exe
Token: SeRestorePrivilege	3184	msiexec.exe
Token: SeTakeOwnershipPrivilege	3184	msiexec.exe
Token: SeRestorePrivilege	3184	msiexec.exe
Token: SeTakeOwnershipPrivilege	3184	msiexec.exe
Token: SeRestorePrivilege	3184	msiexec.exe
Token: SeTakeOwnershipPrivilege	3184	msiexec.exe
Token: SeRestorePrivilege	3184	msiexec.exe
Token: SeTakeOwnershipPrivilege	3184	msiexec.exe
Token: SeRestorePrivilege	3184	msiexec.exe
Token: SeTakeOwnershipPrivilege	3184	msiexec.exe
Token: SeRestorePrivilege	3184	msiexec.exe
Token: SeTakeOwnershipPrivilege	3184	msiexec.exe
Token: SeRestorePrivilege	3184	msiexec.exe

Suspicious use of FindShellTrayWindow 31 IoCs

Processes:

msiexec.exegameguard.exegameguard.exemsedge.exegameguard.exe

pid	process
1596	msiexec.exe
1596	msiexec.exe
3080	gameguard.exe
3080	gameguard.exe
1712	gameguard.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
4500	gameguard.exe

Suspicious use of SendNotifyMessage 16 IoCs

Processes:

gameguard.exegameguard.exemsedge.exegameguard.exe

pid	process
3080	gameguard.exe
3080	gameguard.exe
1712	gameguard.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
4500	gameguard.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

gameguard.exegguard.exeidentity_helper.exe

pid process

4500 gameguard.exe
2628 gguard.exe
228 identity_helper.exe

pid	process
4500	gameguard.exe
2628	gguard.exe
228	identity_helper.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msiexec.exeMsiExec.exeacsvc.exeacsvc.exegameguard.exegguard.exegameguard.exegguard.exemsedge.exe

description	pid	process	target process
PID 3184 wrote to memory of 1344	3184	msiexec.exe	srtasks.exe
PID 3184 wrote to memory of 1344	3184	msiexec.exe	srtasks.exe
PID 3184 wrote to memory of 672	3184	msiexec.exe	MsiExec.exe
PID 3184 wrote to memory of 672	3184	msiexec.exe	MsiExec.exe
PID 3184 wrote to memory of 672	3184	msiexec.exe	MsiExec.exe
PID 672 wrote to memory of 3080	672	MsiExec.exe	gameguard.exe
PID 672 wrote to memory of 3080	672	MsiExec.exe	gameguard.exe
PID 672 wrote to memory of 3080	672	MsiExec.exe	gameguard.exe
PID 2040 wrote to memory of 5056	2040	acsvc.exe	acsvc.exe
PID 2040 wrote to memory of 5056	2040	acsvc.exe	acsvc.exe
PID 2040 wrote to memory of 5056	2040	acsvc.exe	acsvc.exe
PID 5056 wrote to memory of 1712	5056	acsvc.exe	gameguard.exe
PID 5056 wrote to memory of 1712	5056	acsvc.exe	gameguard.exe
PID 5056 wrote to memory of 1712	5056	acsvc.exe	gameguard.exe
PID 1712 wrote to memory of 4168	1712	gameguard.exe	gguard.exe
PID 1712 wrote to memory of 4168	1712	gameguard.exe	gguard.exe
PID 1712 wrote to memory of 4168	1712	gameguard.exe	gguard.exe
PID 4168 wrote to memory of 3372	4168	gguard.exe	verifier.exe
PID 4168 wrote to memory of 3372	4168	gguard.exe	verifier.exe
PID 4500 wrote to memory of 2628	4500	gameguard.exe	gguard.exe
PID 4500 wrote to memory of 2628	4500	gameguard.exe	gguard.exe
PID 4500 wrote to memory of 2628	4500	gameguard.exe	gguard.exe
PID 2628 wrote to memory of 2768	2628	gguard.exe	verifier.exe
PID 2628 wrote to memory of 2768	2628	gguard.exe	verifier.exe
PID 4500 wrote to memory of 544	4500	gameguard.exe	msedge.exe
PID 4500 wrote to memory of 544	4500	gameguard.exe	msedge.exe
PID 544 wrote to memory of 3044	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 3044	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 2132	544	msedge.exe	msedge.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\gameguard_setup.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1596

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3184

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:1344

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 68A0AA281B4DCAB5C9F283DB906210DE C
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:672

C:\Program Files (x86)\GameGuard\gameguard.exe
"C:\Program Files (x86)\GameGuard\gameguard.exe"
3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3080

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Program Files (x86)\GameGuard\acsvc.exe
"C:\Program Files (x86)\GameGuard\acsvc.exe"
1⤵
- Executes dropped EXE
PID:2932

C:\Program Files (x86)\GameGuard\acsvc.exe
"C:\Program Files (x86)\GameGuard\acsvc.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2040

C:\Program Files (x86)\GameGuard\acsvc.exe
"C:\Program Files (x86)\GameGuard\acsvc.exe" --run="C:\Program Files (x86)\GameGuard\gameguard.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056

C:\Program Files (x86)\GameGuard\gameguard.exe
"C:\Program Files (x86)\GameGuard\gameguard.exe"
3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1712

C:\Program Files (x86)\GameGuard\gguard.exe
".\gguard.exe"
4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4168

C:\Windows\system32\verifier.exe
C:\Windows\system32\verifier.exe /volatile /removedriver acdrv.sys
5⤵
PID:3372

C:\Program Files (x86)\GameGuard\gameguard.exe
"C:\Program Files (x86)\GameGuard\gameguard.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500

C:\Program Files (x86)\GameGuard\gguard.exe
".\gguard.exe"
2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628

C:\Windows\system32\verifier.exe
C:\Windows\system32\verifier.exe /volatile /removedriver acdrv.sys
3⤵
PID:2768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cs.fastcup.net/support
2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa9d623cb8,0x7ffa9d623cc8,0x7ffa9d623cd8
3⤵
PID:3044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,17002032262883148362,11172929435272148184,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1848 /prefetch:2
3⤵
PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1856,17002032262883148362,11172929435272148184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
3⤵
PID:580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1856,17002032262883148362,11172929435272148184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:8
3⤵
PID:2588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17002032262883148362,11172929435272148184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
3⤵
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17002032262883148362,11172929435272148184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
3⤵
PID:4100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1856,17002032262883148362,11172929435272148184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
3⤵
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17002032262883148362,11172929435272148184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
3⤵
PID:4832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1856,17002032262883148362,11172929435272148184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6320 /prefetch:8
3⤵
PID:1132

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1856,17002032262883148362,11172929435272148184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6520 /prefetch:8
3⤵
- Suspicious use of SetWindowsHookEx
PID:228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17002032262883148362,11172929435272148184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
3⤵
PID:2768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17002032262883148362,11172929435272148184,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
3⤵
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17002032262883148362,11172929435272148184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
3⤵
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17002032262883148362,11172929435272148184,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:1
3⤵
PID:3468

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1456

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\GameGuard\steam_appid.txt
1⤵
PID:5032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57e427.rbs

Filesize
11KB

MD5
6afcb1a72dec236848d2c968ac613933

SHA1
240d71b8e25416bc2e63fe63734398b4da455f6e

SHA256
2581bb411974354ce9ed801ae370b4196e03c369dc28c3f40efebff22c319df1

SHA512
47a101da4e1e7fda7d2198c7b9ceef6fa8caa7f49a2e0a27f3aa5a3cf9fd029e462893e4ddda2a63ec6acaf874cdd0e710ab1c41b25efca06ff287e1b3499f3b

Download Submit
C:\Program Files (x86)\GameGuard\acsvc.exe

Filesize
316KB

MD5
7ec55f85dd4740e6f146d3ee54e01201

SHA1
44fcf3bb83a006ab6ca90d728bec43c031e0cada

SHA256
7997c3e9c03c0e91b8b07cb482c97066afdd483d2dbab1f292f749f4fe97e229

SHA512
7b6a494b5506e249e67e63c32fe42895227ec53a49f37e9b3884f628fd7bcc29f1f8bf96d616b8b741adc48540fc8eda7e64701a459acb707569bd1e36ee143b

Download Submit
C:\Program Files (x86)\GameGuard\acsvc.exe

Filesize
316KB

MD5
7ec55f85dd4740e6f146d3ee54e01201

SHA1
44fcf3bb83a006ab6ca90d728bec43c031e0cada

SHA256
7997c3e9c03c0e91b8b07cb482c97066afdd483d2dbab1f292f749f4fe97e229

SHA512
7b6a494b5506e249e67e63c32fe42895227ec53a49f37e9b3884f628fd7bcc29f1f8bf96d616b8b741adc48540fc8eda7e64701a459acb707569bd1e36ee143b

Download Submit
C:\Program Files (x86)\GameGuard\acsvc.exe

Filesize
330KB

MD5
b966184ae28d7bc96756bc3ed001c701

SHA1
8c620632624e9bc9b3e7d7a672072bdb6952df87

SHA256
f2b6185392b98f27da4a7a8c74b585ae00d6e69bd7f97727dca0953aa3ab0324

SHA512
8b9ad0bec94ed9a44a0c8aa8b8ca1b80fc6aecc46a2d74a2eb3830394ece82a77bed121c49ccbc6fb4fb7c05edbc90c17d591c2ee0f88bd3018893bc4cd0e003

Download Submit
C:\Program Files (x86)\GameGuard\acsvc.exe

Filesize
330KB

MD5
b966184ae28d7bc96756bc3ed001c701

SHA1
8c620632624e9bc9b3e7d7a672072bdb6952df87

SHA256
f2b6185392b98f27da4a7a8c74b585ae00d6e69bd7f97727dca0953aa3ab0324

SHA512
8b9ad0bec94ed9a44a0c8aa8b8ca1b80fc6aecc46a2d74a2eb3830394ece82a77bed121c49ccbc6fb4fb7c05edbc90c17d591c2ee0f88bd3018893bc4cd0e003

Download Submit
C:\Program Files (x86)\GameGuard\acsvc.exe

Filesize
330KB

MD5
b966184ae28d7bc96756bc3ed001c701

SHA1
8c620632624e9bc9b3e7d7a672072bdb6952df87

SHA256
f2b6185392b98f27da4a7a8c74b585ae00d6e69bd7f97727dca0953aa3ab0324

SHA512
8b9ad0bec94ed9a44a0c8aa8b8ca1b80fc6aecc46a2d74a2eb3830394ece82a77bed121c49ccbc6fb4fb7c05edbc90c17d591c2ee0f88bd3018893bc4cd0e003

Download Submit
C:\Program Files (x86)\GameGuard\cache\chrorweq.cache

Filesize
330KB

MD5
b966184ae28d7bc96756bc3ed001c701

SHA1
8c620632624e9bc9b3e7d7a672072bdb6952df87

SHA256
f2b6185392b98f27da4a7a8c74b585ae00d6e69bd7f97727dca0953aa3ab0324

SHA512
8b9ad0bec94ed9a44a0c8aa8b8ca1b80fc6aecc46a2d74a2eb3830394ece82a77bed121c49ccbc6fb4fb7c05edbc90c17d591c2ee0f88bd3018893bc4cd0e003

Download Submit
C:\Program Files (x86)\GameGuard\cache\jgvrxrf.cache

Filesize
16B

MD5
f5b5cb5adc1697570707c7b14a1c8005

SHA1
da8f4df8684b9e2102f9a6255862fa3c64b65f98

SHA256
4d850b3f2712b8fd03182627839f245400f59dec4c0f6729e3da860f277833bc

SHA512
4b4153b392f8d2bfa5b40a2775b7d15aca20efd350d6aab1dc0f19996eeacd2c50712d1ed0a0ca4f1c72a0d31a1fdbb0340fb85ca0c1a123e12618a025108654

Download Submit
C:\Program Files (x86)\GameGuard\cache\mrcaospw.cache

Filesize
251KB

MD5
3dbd633d37bdc0712b837aae2e2ec8f5

SHA1
1cd21533b8f869f5cb44c3e101c427fa91a70768

SHA256
4bd185ee9a98ff82708ffe787b0fd204ca971c7e7746adc061827a85884c27b1

SHA512
10bd1777daeb4962c23ae37c2b621e0bfd993dd6eed4a9dd6c48e3fbeed8f8ae9e398d46f00e73ccadb520e7b8398c5a99792528e4b5b0eb083156ce14e1e644

Download Submit
C:\Program Files (x86)\GameGuard\cache\pdvnovtq.cache

Filesize
15.2MB

MD5
672fde6659e3b00a98a8fe84084f3dec

SHA1
f6e63c0e89804bbe43b4c458b9c20bfe19a6c27c

SHA256
7fdbfcd257064a70f3115f6b3d71b16918966c6254dad8bfd2fd23b990a72a0d

SHA512
69035f31bcd3d3f7bc7071f50a830820ebad1266267a2d5ed61e37c2c508f13fe59b26fa1b0defe9166210cb556f32da5ceeb99e37e82f0c52cf0ac9acdeeefe

Download Submit
C:\Program Files (x86)\GameGuard\cache\sujcmfbx.cache

Filesize
52.5MB

MD5
2563ed229622d628d0a22e80987b7221

SHA1
8ee728004608ddf8116e618bc38a5863fe52f77d

SHA256
54417cb3369b0a7ea037532fddae6ff355e276eda9a3bcdc98beacad5d63f0e6

SHA512
f9e9ebd5bb02ed6667f4c0b31ce940defb0b7fae65bfe84ab07bc84d7e8f147f2febb1eee6b0e87bdf48a7212acf5886a3987e92b3c892dd54e3a5908752ee91

Download Submit
C:\Program Files (x86)\GameGuard\gameguard.exe

Filesize
7.2MB

MD5
81ed38976254bb646c0ecee753324027

SHA1
c3fe70f9daff9e66b315b2adc9481a7d39d7e7c6

SHA256
cf169e7a746c574f3e2ec653a6739ca71fe0e34aa76f604cd36706fe45536be7

SHA512
476a6f9f65857d015661dc8504c537efff00fbd69014ab2e36aeed393b69083962195b3aa6e4485aa46f7471aa59aec21a6e56a687fc6474cc7a62b9c47ca018

Download Submit
C:\Program Files (x86)\GameGuard\gameguard.exe

Filesize
7.2MB

MD5
81ed38976254bb646c0ecee753324027

SHA1
c3fe70f9daff9e66b315b2adc9481a7d39d7e7c6

SHA256
cf169e7a746c574f3e2ec653a6739ca71fe0e34aa76f604cd36706fe45536be7

SHA512
476a6f9f65857d015661dc8504c537efff00fbd69014ab2e36aeed393b69083962195b3aa6e4485aa46f7471aa59aec21a6e56a687fc6474cc7a62b9c47ca018

Download Submit
C:\Program Files (x86)\GameGuard\gameguard.exe

Filesize
7.2MB

MD5
81ed38976254bb646c0ecee753324027

SHA1
c3fe70f9daff9e66b315b2adc9481a7d39d7e7c6

SHA256
cf169e7a746c574f3e2ec653a6739ca71fe0e34aa76f604cd36706fe45536be7

SHA512
476a6f9f65857d015661dc8504c537efff00fbd69014ab2e36aeed393b69083962195b3aa6e4485aa46f7471aa59aec21a6e56a687fc6474cc7a62b9c47ca018

Download Submit
C:\Program Files (x86)\GameGuard\gameguard.exe

Filesize
15.2MB

MD5
672fde6659e3b00a98a8fe84084f3dec

SHA1
f6e63c0e89804bbe43b4c458b9c20bfe19a6c27c

SHA256
7fdbfcd257064a70f3115f6b3d71b16918966c6254dad8bfd2fd23b990a72a0d

SHA512
69035f31bcd3d3f7bc7071f50a830820ebad1266267a2d5ed61e37c2c508f13fe59b26fa1b0defe9166210cb556f32da5ceeb99e37e82f0c52cf0ac9acdeeefe

Download Submit
C:\Program Files (x86)\GameGuard\gameguard.exe

Filesize
15.2MB

MD5
672fde6659e3b00a98a8fe84084f3dec

SHA1
f6e63c0e89804bbe43b4c458b9c20bfe19a6c27c

SHA256
7fdbfcd257064a70f3115f6b3d71b16918966c6254dad8bfd2fd23b990a72a0d

SHA512
69035f31bcd3d3f7bc7071f50a830820ebad1266267a2d5ed61e37c2c508f13fe59b26fa1b0defe9166210cb556f32da5ceeb99e37e82f0c52cf0ac9acdeeefe

Download Submit
C:\Program Files (x86)\GameGuard\gameguard.exe

Filesize
15.2MB

MD5
672fde6659e3b00a98a8fe84084f3dec

SHA1
f6e63c0e89804bbe43b4c458b9c20bfe19a6c27c

SHA256
7fdbfcd257064a70f3115f6b3d71b16918966c6254dad8bfd2fd23b990a72a0d

SHA512
69035f31bcd3d3f7bc7071f50a830820ebad1266267a2d5ed61e37c2c508f13fe59b26fa1b0defe9166210cb556f32da5ceeb99e37e82f0c52cf0ac9acdeeefe

Download Submit
C:\Program Files (x86)\GameGuard\gguard.exe

Filesize
52.5MB

MD5
03426508c197f0fb93d40f23207f0b65

SHA1
6e9290637e864861d2cb83eb2b30e172575c38ae

SHA256
6838273835134318062a8c1ca9e1e94efd7da9f05995330f2a05d3fd6fd33eab

SHA512
cd71ce2e1a24a48caf625c6819bc65f9797cec4e611d533b452c0c07993b78ee37b3e96a1b17e919ec9779d48b3062051ed8534b3f2ee65ccfbca649af2e8018

Download Submit
C:\Program Files (x86)\GameGuard\gguard.exe

Filesize
52.5MB

MD5
03426508c197f0fb93d40f23207f0b65

SHA1
6e9290637e864861d2cb83eb2b30e172575c38ae

SHA256
6838273835134318062a8c1ca9e1e94efd7da9f05995330f2a05d3fd6fd33eab

SHA512
cd71ce2e1a24a48caf625c6819bc65f9797cec4e611d533b452c0c07993b78ee37b3e96a1b17e919ec9779d48b3062051ed8534b3f2ee65ccfbca649af2e8018

Download Submit
C:\Program Files (x86)\GameGuard\gguard.exe

Filesize
52.5MB

MD5
03426508c197f0fb93d40f23207f0b65

SHA1
6e9290637e864861d2cb83eb2b30e172575c38ae

SHA256
6838273835134318062a8c1ca9e1e94efd7da9f05995330f2a05d3fd6fd33eab

SHA512
cd71ce2e1a24a48caf625c6819bc65f9797cec4e611d533b452c0c07993b78ee37b3e96a1b17e919ec9779d48b3062051ed8534b3f2ee65ccfbca649af2e8018

Download Submit
C:\Program Files (x86)\GameGuard\gguard.exe

Filesize
52.5MB

MD5
03426508c197f0fb93d40f23207f0b65

SHA1
6e9290637e864861d2cb83eb2b30e172575c38ae

SHA256
6838273835134318062a8c1ca9e1e94efd7da9f05995330f2a05d3fd6fd33eab

SHA512
cd71ce2e1a24a48caf625c6819bc65f9797cec4e611d533b452c0c07993b78ee37b3e96a1b17e919ec9779d48b3062051ed8534b3f2ee65ccfbca649af2e8018

Download Submit
C:\Program Files (x86)\GameGuard\launcher_x64

Filesize
52.5MB

MD5
03426508c197f0fb93d40f23207f0b65

SHA1
6e9290637e864861d2cb83eb2b30e172575c38ae

SHA256
6838273835134318062a8c1ca9e1e94efd7da9f05995330f2a05d3fd6fd33eab

SHA512
cd71ce2e1a24a48caf625c6819bc65f9797cec4e611d533b452c0c07993b78ee37b3e96a1b17e919ec9779d48b3062051ed8534b3f2ee65ccfbca649af2e8018

Download Submit
C:\Program Files (x86)\GameGuard\steam_api.dll

Filesize
251KB

MD5
844785d10e81cb5a99da47b73af09489

SHA1
6446e3c75324f2653975657f940cbcf593ec2e51

SHA256
765fb6498ba7d262e63b2dba19c09f63de4dd0a092b5499828ec8949aa183f82

SHA512
f7f38967e8a613a80954bf9b5a92d6c5aa4ecf8c398e4af59dff43fc4969464335e4ec73e94548a69cd1afbb5b485adab2ca5056a2f5890d4ec7f488eee8e860

Download Submit
C:\Program Files (x86)\GameGuard\steam_api.dll

Filesize
251KB

MD5
844785d10e81cb5a99da47b73af09489

SHA1
6446e3c75324f2653975657f940cbcf593ec2e51

SHA256
765fb6498ba7d262e63b2dba19c09f63de4dd0a092b5499828ec8949aa183f82

SHA512
f7f38967e8a613a80954bf9b5a92d6c5aa4ecf8c398e4af59dff43fc4969464335e4ec73e94548a69cd1afbb5b485adab2ca5056a2f5890d4ec7f488eee8e860

Download Submit
C:\Program Files (x86)\GameGuard\steam_api.dll

Filesize
251KB

MD5
844785d10e81cb5a99da47b73af09489

SHA1
6446e3c75324f2653975657f940cbcf593ec2e51

SHA256
765fb6498ba7d262e63b2dba19c09f63de4dd0a092b5499828ec8949aa183f82

SHA512
f7f38967e8a613a80954bf9b5a92d6c5aa4ecf8c398e4af59dff43fc4969464335e4ec73e94548a69cd1afbb5b485adab2ca5056a2f5890d4ec7f488eee8e860

Download Submit
C:\Program Files (x86)\GameGuard\steam_api.dll

Filesize
251KB

MD5
844785d10e81cb5a99da47b73af09489

SHA1
6446e3c75324f2653975657f940cbcf593ec2e51

SHA256
765fb6498ba7d262e63b2dba19c09f63de4dd0a092b5499828ec8949aa183f82

SHA512
f7f38967e8a613a80954bf9b5a92d6c5aa4ecf8c398e4af59dff43fc4969464335e4ec73e94548a69cd1afbb5b485adab2ca5056a2f5890d4ec7f488eee8e860

Download Submit
C:\Program Files (x86)\GameGuard\steam_appid.txt

Filesize
3B

MD5
5f0f5e5f33945135b874349cfbed4fb9

SHA1
de8627f75ba1abcfafd00a0e75ad189105cfdc21

SHA256
42c6024940120036d7a0103375d5b8e5072589f6d0f9a1a8e7f6eb6a17358675

SHA512
5da80d9b6aca0f09864d6ce31381361564c8504ad294d2344a4106f51a7e25e6f22ef256efe32a4e774173d60599e2e938da2020b70f8c115e587b5420eb478f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
893B

MD5
d4ae187b4574036c2d76b6df8a8c1a30

SHA1
b06f409fa14bab33cbaf4a37811b8740b624d9e5

SHA256
a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

SHA512
1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
252B

MD5
ff6b323c8ad29ceb50ca05f3627d0bfb

SHA1
05ce1be8e95efcd8152d10b251a2ab7b44d4a976

SHA256
2e9403d2454d9716cc9af24d430fc29e14f68ae1727fae2b2e142ea31d00488b

SHA512
a7038cf3bc2f74c25cb0c365c09a2694bebda1ca4eeff7c517421199c08d95b6e9a04931d59031fa01c8020398b33ba1aac4a6527bb0afc5060b5d56a5d3a394

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
252B

MD5
ff6b323c8ad29ceb50ca05f3627d0bfb

SHA1
05ce1be8e95efcd8152d10b251a2ab7b44d4a976

SHA256
2e9403d2454d9716cc9af24d430fc29e14f68ae1727fae2b2e142ea31d00488b

SHA512
a7038cf3bc2f74c25cb0c365c09a2694bebda1ca4eeff7c517421199c08d95b6e9a04931d59031fa01c8020398b33ba1aac4a6527bb0afc5060b5d56a5d3a394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db2e4d9e346a898461d3dd73a9bd1489

SHA1
ed0676dbbdfb85caa47514b1ed9bd1686e2b5973

SHA256
63ec89c40c09cda645f11eed75b85d332b5898d774d56ac761f511a36216bbee

SHA512
64979cc44300f1b648c1fe78b4a272fcdfcfd3e2f2b50bc6c8a780aaa074916cd2061b45642f719a2d9790d3dee7bf159e59081eeccadca38a1a5c638efebd06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
3e8f84828e984387cbf9fc8d79b4d81d

SHA1
831c0803e365acee2fa348b65fb00342a92bf67a

SHA256
7775c0a71a43c850798ae1e72540443228f0fd1cffb6933da22fcf0c1890b03d

SHA512
3809ab125cf4f081359c1bb30642ff649b78a81bb637e6167ae2cf4fd900dcfd45ea4d16eaab4e3c110a5963d42c4cca817e621583c2dd8b66105c812b811c36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d429f873d46cfce9d321646ab4ddddb5

SHA1
cc34967291c876aa88af01831dd6318fb51da803

SHA256
b4c7445c8ab6b856a6ddb87c455b9b7e886e83599f1a280724fcdfdd36e93112

SHA512
a96e5ef54b6aa444714ca466c7cf4ad15146fc0c651d54af172f1ea005396b65415075ea1c4bff08464e68c726a514ed4afaaae2c2144b94978ab0b1a025a2df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
86debc9c83c2c62cb82ce4badf9e6cfb

SHA1
6e25c253695eefb77f678364e0aabd637e809c67

SHA256
cd0f6216158db84f55d799b0138d5a19cfa16c7a0d3cd880ee931349962b493e

SHA512
df124a4df04781d9e235e50532bb3192354da0492f2b66fca589f8e1d8135614b97e60fad3452a0a032f088cffe4e32c078813ac9e60b8d3160b30011447b8b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a86721f7b8dd3238482918bcdea5b90c

SHA1
7a389de5e43585c356333d0f3619d3fffe4b26f7

SHA256
274984e5800d7f61717c0cc2794c1954932b5b740e02ddfa48e6d1dda1b9fbef

SHA512
32bd54792900b3db96e05f5ada3b06038b777b65adfa5aeea86dc9fe04b0115ce3717f271e3b8057c331415ad94b7668577d8dcf915e60684b40051aae8a4219

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
c058d43c86c549232b38f4ec339e5f5f

SHA1
d5f2ccc3a00935f7dbc402fe248e62dea3ea80a6

SHA256
5279a4e706dce4b6989d95d10ca1443df59bfcf0986783f6e9685a0b003b49f7

SHA512
19dc392d1cfd9c59e3d8b58a23c28fead2c3af9341e36dc3aca0e5872f9768a368fd886f37df312cb0ff3983cea01ff200c0725062c54197439bafac070f0ae6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
264B

MD5
21b38cc4223aeabd8eb08228b25c5040

SHA1
0281782c634ab00370e1f95a09c8e768405cf137

SHA256
bd0fc5eea5fb7faf196ff5d15a9bbd80ec4d2279cf25346731a400a6b8f9e843

SHA512
a1dc789cd1b1678a55d8a6d25aaad073330fcd9bbb93a353d9a6fc600aa2443999267a0f21031aacd79c5792b8ea1f2117a1d2a83d569605265806e8e96fc4a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe599428.TMP

Filesize
48B

MD5
7428b2cd737fe069c24c4e6eb135af25

SHA1
1ba683039ebd76520165b317dd41934cb2e67504

SHA256
b9967e2a2ba39e3793024ac5b6bd5fde5e17711444c713804201969ad323dd7a

SHA512
87d46e3fb9d84214f577ca9d5100d0c9ce37f00120809ba1eafb400dc3180f7a574d22e8fe09825902744a87c9eb2a2902087c0f6c5d3133f41cf082a4825f66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
9e3b27344ac823e97654663ef2a349d0

SHA1
ce3503efeb5fa778ace3ecd950ee257db703819b

SHA256
8f4834a53f31468a36bebb5b9a8bfdd53d7729fa496aab62a3599670cbc6b127

SHA512
3a77b2f27026d96e986e7216e751c63c7ebacdb783d5a5d509f76a2847cc9fedc9e5905bf127910c04619ca2c996b5fe7c03047da01012e2901a69bb7548c5bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
22fc9d7e4e6b4554f8dc61c29547c625

SHA1
a4d624c8ef99437e4085f1f1fc49720b94243ac7

SHA256
98c46c1b748b7b92921727f8243e1409e297eae88a1b5461542c5ec9df821869

SHA512
f3130957b5f3c620f18f48c64eb90e14aef9b7b7e1fe84c684854063827f49dd14f20e9e43c933022cba0282329c855038a623efe94aafbcd120e60d11cf75e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe596596.TMP

Filesize
4KB

MD5
282d975f8824dbd6a533de34b9f97aab

SHA1
cd79957eb6320b1644cc6c34f096ff4698701d47

SHA256
38f55c408a9a785bf608c0a14ca0880b9e4f6bba63c8d71bd356e8b3344d44d1

SHA512
961562e3b38f1a5bc7cbbcf80b4cbbf9ebe12096b171051d086ee419f72bf84d5f808faaa3b86c36acf59f5f883c95b4513f927bed18dc80160f36c0f331820c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
94901eeb7a894b5ddee21f307848ac78

SHA1
22d79603150b74fa1ce9628a4e9c33c614c3b325

SHA256
77a7bec96621da1457239c9364bfbb7eb39cbfcda88d56ff27e8af97ae0d2b0b

SHA512
206a6049e234d177d16312a70c6f4b8e1fc3402780b51298f5dba39bdbb432b0958ec2b4b61eec2fe76a449a64bea56db6ce89de7bced30fcf1dc7188f6403d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
be7f7d7e777ada4e3e7a442424d3f865

SHA1
a3d7452fac2bbe010300bc66ab1c9c4e03ee7f8d

SHA256
04a8bb1a167b04c33b7322b7eff4af35d81fd41208f8160a165285baf590b960

SHA512
301504ae9e17799d364cdd0a800933a73e8003d12675264039367c497921d3c0cdebe3bdb54dfd3a338043571726b4426426c35ad00b6cd294dfd7661cc544eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF608.tmp

Filesize
202KB

MD5
d773d9bd091e712df7560f576da53de8

SHA1
165cfbdce1811883360112441f7237b287cf0691

SHA256
e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7

SHA512
15a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF608.tmp

Filesize
202KB

MD5
d773d9bd091e712df7560f576da53de8

SHA1
165cfbdce1811883360112441f7237b287cf0691

SHA256
e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7

SHA512
15a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd

Download Submit
C:\Windows\Installer\e57e426.msi

Filesize
7.7MB

MD5
68bd8f9af44479db013a77c806f1c674

SHA1
0cbb2b63c78b42e13b1818964bb2cf43e46c5052

SHA256
ac9ac5a95273064ba09af8be049124ba52db7a59075d69a94d12427917dbc376

SHA512
991f703293b984beeeda44cc72cacc0cd69bd4cb1856b2b1c5cf2a2d06d7f58e8469af70c2ecece05d98643937c52f8a944b9892e2925738457d2ac238867852

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
12.2MB

MD5
5402bcfbe6d8134586629398032b5fee

SHA1
817b912bf267fb4ff04aba141691ec6826e100f6

SHA256
a52937f16bc1e5a816544fcc9d1f005848a8c38815c2a4786925b61d0e08ce86

SHA512
824a6db64b89541b251c54d29dccbe92d48518523a88db1f2b252f2e7f72b3347530fabed3b5d6e8f8079d4e20adef1058b1ac1e3af5d41a28f921b274f28b5b

Download Submit
\??\Volume{2115988a-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{82b2dc5e-ebcc-4c02-b7d0-66daebfb43d6}_OnDiskSnapshotProp

Filesize
6KB

MD5
4c435a2ea80c989c3af4ed416aa002da

SHA1
716dd7f4cb4da3d8189723fe6680e3ccd729567f

SHA256
138ab745b03c51c5129f666aebbf91ff905adeceeda99d01c9bf863c62c40860

SHA512
dd36d89aaedfac639829e4e00e594fe6020989bd4868a83a8f007b59b61a52cda90ada1464b961a02fed28719a236dd6026b2b9ec0c3e1d87a8ded712916e9a3

Download Submit
\??\pipe\LOCAL\crashpad_544_CPZEVJPQRIXLITNP

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1712-82-0x0000000003FB0000-0x0000000003FB1000-memory.dmp

Filesize
4KB

Download
memory/1712-80-0x0000000003FA0000-0x0000000003FA1000-memory.dmp

Filesize
4KB

Download
memory/1712-125-0x0000000000460000-0x0000000001D33000-memory.dmp

Filesize
24.8MB

Download
memory/1712-81-0x0000000000460000-0x0000000001D33000-memory.dmp

Filesize
24.8MB

Download
memory/1712-77-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/1712-78-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/1712-76-0x0000000000460000-0x0000000001D33000-memory.dmp

Filesize
24.8MB

Download
memory/1712-79-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/1712-113-0x0000000000460000-0x0000000001D33000-memory.dmp

Filesize
24.8MB

Download
memory/1712-83-0x0000000003FC0000-0x0000000003FC1000-memory.dmp

Filesize
4KB

Download
memory/1712-84-0x0000000003FD0000-0x0000000003FD1000-memory.dmp

Filesize
4KB

Download
memory/1712-85-0x0000000003FF0000-0x0000000003FF1000-memory.dmp

Filesize
4KB

Download
memory/1712-86-0x0000000000460000-0x0000000001D33000-memory.dmp

Filesize
24.8MB

Download
memory/2628-158-0x0000000008D60000-0x0000000008D61000-memory.dmp

Filesize
4KB

Download
memory/2628-153-0x0000000007130000-0x0000000007131000-memory.dmp

Filesize
4KB

Download
memory/2628-161-0x0000000000A70000-0x0000000006D33000-memory.dmp

Filesize
98.8MB

Download
memory/2628-160-0x0000000008D80000-0x0000000008D81000-memory.dmp

Filesize
4KB

Download
memory/2628-159-0x0000000008D70000-0x0000000008D71000-memory.dmp

Filesize
4KB

Download
memory/2628-157-0x0000000008D50000-0x0000000008D51000-memory.dmp

Filesize
4KB

Download
memory/2628-156-0x0000000008D40000-0x0000000008D41000-memory.dmp

Filesize
4KB

Download
memory/2628-155-0x0000000007160000-0x0000000007161000-memory.dmp

Filesize
4KB

Download
memory/2628-154-0x0000000007150000-0x0000000007151000-memory.dmp

Filesize
4KB

Download
memory/3080-67-0x0000000000E00000-0x00000000019BE000-memory.dmp

Filesize
11.7MB

Download
memory/3080-55-0x0000000003050000-0x0000000003051000-memory.dmp

Filesize
4KB

Download
memory/3080-46-0x0000000000E00000-0x00000000019BE000-memory.dmp

Filesize
11.7MB

Download
memory/3080-47-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/3080-49-0x0000000000E00000-0x00000000019BE000-memory.dmp

Filesize
11.7MB

Download
memory/3080-50-0x0000000003000000-0x0000000003001000-memory.dmp

Filesize
4KB

Download
memory/3080-48-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

Filesize
4KB

Download
memory/3080-51-0x0000000003010000-0x0000000003011000-memory.dmp

Filesize
4KB

Download
memory/3080-52-0x0000000003020000-0x0000000003021000-memory.dmp

Filesize
4KB

Download
memory/3080-53-0x0000000003030000-0x0000000003031000-memory.dmp

Filesize
4KB

Download
memory/3080-54-0x0000000003040000-0x0000000003041000-memory.dmp

Filesize
4KB

Download
memory/3080-56-0x0000000000E00000-0x00000000019BE000-memory.dmp

Filesize
11.7MB

Download
memory/4168-115-0x0000000000E60000-0x0000000007123000-memory.dmp

Filesize
98.8MB

Download
memory/4168-114-0x0000000009440000-0x0000000009441000-memory.dmp

Filesize
4KB

Download
memory/4168-112-0x0000000009430000-0x0000000009431000-memory.dmp

Filesize
4KB

Download
memory/4168-111-0x0000000009420000-0x0000000009421000-memory.dmp

Filesize
4KB

Download
memory/4168-110-0x0000000009410000-0x0000000009411000-memory.dmp

Filesize
4KB

Download
memory/4168-106-0x0000000007C90000-0x0000000007C91000-memory.dmp

Filesize
4KB

Download
memory/4168-109-0x0000000007CC0000-0x0000000007CC1000-memory.dmp

Filesize
4KB

Download
memory/4168-108-0x0000000007CB0000-0x0000000007CB1000-memory.dmp

Filesize
4KB

Download
memory/4168-107-0x0000000007CA0000-0x0000000007CA1000-memory.dmp

Filesize
4KB

Download
memory/4500-136-0x0000000003DE0000-0x0000000003DE1000-memory.dmp

Filesize
4KB

Download
memory/4500-137-0x0000000000460000-0x0000000001D33000-memory.dmp

Filesize
24.8MB

Download
memory/4500-271-0x0000000000460000-0x0000000001D33000-memory.dmp

Filesize
24.8MB

Download
memory/4500-168-0x0000000000460000-0x0000000001D33000-memory.dmp

Filesize
24.8MB

Download
memory/4500-127-0x0000000000460000-0x0000000001D33000-memory.dmp

Filesize
24.8MB

Download
memory/4500-130-0x0000000000460000-0x0000000001D33000-memory.dmp

Filesize
24.8MB

Download
memory/4500-135-0x0000000003DD0000-0x0000000003DD1000-memory.dmp

Filesize
4KB

Download
memory/4500-134-0x0000000003DC0000-0x0000000003DC1000-memory.dmp

Filesize
4KB

Download
memory/4500-128-0x0000000001F40000-0x0000000001F41000-memory.dmp

Filesize
4KB

Download
memory/4500-133-0x0000000003DA0000-0x0000000003DA1000-memory.dmp

Filesize
4KB

Download
memory/4500-132-0x0000000003D90000-0x0000000003D91000-memory.dmp

Filesize
4KB

Download
memory/4500-129-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/4500-131-0x0000000003D60000-0x0000000003D61000-memory.dmp

Filesize
4KB

Download