b0f13e3c10d153695d3860b900fb9651458238a7e67f05903c72070391f4a374

Analysis

max time kernel
104s
max time network
105s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
31/03/2024, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GameforgeInstaller.exe
Size 2.2MB
Sample240331-3ejczafe46
SHA256 b0f13e3c10d153695d3860b900fb9651458238a7e67f05903c72070391f4a374
MD5 73ea8f353dc081ddb1db0fd35dc0bd15
SHA1 be8de36487570de1827fcd483e0b3e9f95874622
SHA512 0992519c3541c654d6e773bcf439df20768d69fb1d9378182109ae83c43fe2605c3692aa8650792ac0488076df33b008ec127c5bb28a3364d8960a401703f90a
SSDEEP 49152:kBto5T8wV7oI+qco4xDL/U8ElLrpqlnAn4z+c4SG+4mOPDICVtYE9p+K:kBu5TT7oIgo4xlRDtty9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

google discovery phishing

Malware Config

Signatures

Detected google phishing page
phishing google
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Control Panel\International\Geo\Nation	SparkWebHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Control Panel\International\Geo\Nation	gfclient.exe

Executes dropped EXE 10 IoCs

pid	Process
4960	GameforgeLoginSetup.exe
1460	GameforgeLoginSetup.tmp
4932	vcredist_x86.exe
2324	vcredist_x86.exe
856	gfservice.exe
2644	gfclient.exe
3472	gfservice.exe
3428	SparkWebHelper.exe
392	SparkWebHelper.exe
2688	SparkWebHelper.exe

Loads dropped DLL 64 IoCs

pid	Process
2324	vcredist_x86.exe
856	gfservice.exe
856	gfservice.exe
856	gfservice.exe
856	gfservice.exe
856	gfservice.exe
856	gfservice.exe
856	gfservice.exe
856	gfservice.exe
856	gfservice.exe
856	gfservice.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
3472	gfservice.exe
3472	gfservice.exe
3472	gfservice.exe
3472	gfservice.exe
3472	gfservice.exe
3472	gfservice.exe
3472	gfservice.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
3428	SparkWebHelper.exe
3428	SparkWebHelper.exe
3428	SparkWebHelper.exe
3428	SparkWebHelper.exe
3428	SparkWebHelper.exe
3428	SparkWebHelper.exe
3428	SparkWebHelper.exe
392	SparkWebHelper.exe
392	SparkWebHelper.exe
392	SparkWebHelper.exe
392	SparkWebHelper.exe
2688	SparkWebHelper.exe
2688	SparkWebHelper.exe
2688	SparkWebHelper.exe
2688	SparkWebHelper.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	gfservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	gfservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_B5DA75AC5C130C8FE4039EA84C08E708	gfservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_B5DA75AC5C130C8FE4039EA84C08E708	gfservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	gfservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	gfservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	gfservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	gfservice.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-string-l1-1-0.dll	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-console-l1-1-0.dll	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\imageformats\qtiff.dll	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\translations\is-NDDMU.tmp	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\dll\dwmapi.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\symbols\DLL\hid.pdb	gfclient.exe
File created	C:\Program Files (x86)\GameforgeClient\translations\is-ONFFH.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\api-ms-win-core-processthreads-l1-1-0.dll	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\dll\wwin32u.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\dxgi.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\credui.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\Qt5Gui.dll	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\Qt5Network.dll	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-conio-l1-1-0.dll	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\is-47S0N.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\translations\is-2OCF4.tmp	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\dll\cryptbase.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\wsspicli.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\dll\secur32.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\dll\chrome_elf.dll.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\webio.pdb	gfclient.exe
File created	C:\Program Files (x86)\GameforgeClient\MSVC-CRT\is-ICGNI.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\translations\is-3FO9T.tmp	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\symbols\dll\profapi.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\d3d11.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\imageformats\qsvg.dll	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\resources\locales\is-CN0P1.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\translations\is-GC0L4.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\api-ms-win-core-heap-l1-1-0.dll	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\resources\licenses\is-5PA90.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\resources\locales\is-VMJGU.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\swiftshader\is-H2175.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\api-ms-win-crt-convert-l1-1-0.dll	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\DLL\wkernel32.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\oleacc.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\symbols\dll\urlmon.pdb	gfclient.exe
File created	C:\Program Files (x86)\GameforgeClient\ucrtbase.dll	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\dll\qjsonrpc1.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\gfclient.exe	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\is-A1OF9.tmp	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\shell32.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\symbols\dll\qjsonrpc1.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\dll\dxgi.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\symbols\dll\OnDemandConnRouteHelper.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\unins000.dat	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\api-ms-win-core-console-l1-1-0.dll	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\api-ms-win-core-datetime-l1-1-0.dll	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\api-ms-win-core-rtlsupport-l1-1-0.dll	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\dll\Qt5Widgets.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\symbols\dll\secur32.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\symbols\dll\d3d11.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\cryptnet.pdb	gfclient.exe
File created	C:\Program Files (x86)\GameforgeClient\MSVC-CRT\is-4QG8S.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\resources\fonts\is-VDLTH.tmp	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\dll\ole32.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\wimm32.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\fastprox.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\wkscli.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\dll\fwpuclnt.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\swiftshader\libGLESv2.dll	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\is-CQRNH.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\is-BEKQN.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\MSVC-CRT\is-73KTV.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\translations\is-EI7TH.tmp	GameforgeLoginSetup.tmp

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Gameforge4d	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Gameforge4d\GameforgeClient	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	gfservice.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	gfservice.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gfclient\shell\open\command	GameforgeLoginSetup.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 2a6f6319c383da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{CE7DBBA2-60E7-474E-BF12-4A4510A37386} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gfclient\shell\open\command\ = "\"C:\\Program Files (x86)\\GameforgeClient\\gfclient.exe\" \"%1\""	GameforgeLoginSetup.tmp
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{E20DB51A-9679-412B-9B0C-11D20EC55AAB} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 9 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	gfclient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	gfclient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	gfclient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	gfservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	gfservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	gfservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	gfclient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	gfclient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	gfclient.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2644	gfclient.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1460	GameforgeLoginSetup.tmp
1460	GameforgeLoginSetup.tmp
2644	gfclient.exe
2644	gfclient.exe
3472	gfservice.exe
3472	gfservice.exe
3472	gfservice.exe
3472	gfservice.exe
3428	SparkWebHelper.exe
3428	SparkWebHelper.exe
392	SparkWebHelper.exe
392	SparkWebHelper.exe
2688	SparkWebHelper.exe
2688	SparkWebHelper.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1996	MicrosoftEdgeCP.exe
1996	MicrosoftEdgeCP.exe
1996	MicrosoftEdgeCP.exe
1996	MicrosoftEdgeCP.exe
3740	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeBackupPrivilege	3472	gfservice.exe
Token: SeRestorePrivilege	3472	gfservice.exe
Token: SeDebugPrivilege	1840	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1840	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1840	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1840	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	200	MicrosoftEdge.exe
Token: SeDebugPrivilege	200	MicrosoftEdge.exe
Token: SeBackupPrivilege	3472	gfservice.exe
Token: SeRestorePrivilege	3472	gfservice.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1460	GameforgeLoginSetup.tmp
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe
2644	gfclient.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
2644	gfclient.exe
2644	gfclient.exe
3472	gfservice.exe
2644	gfclient.exe
200	MicrosoftEdge.exe
1996	MicrosoftEdgeCP.exe
1840	MicrosoftEdgeCP.exe
1996	MicrosoftEdgeCP.exe
1592	MicrosoftEdge.exe
1908	MicrosoftEdgeCP.exe
1908	MicrosoftEdgeCP.exe
3196	MicrosoftEdge.exe
3740	MicrosoftEdgeCP.exe
3740	MicrosoftEdgeCP.exe
3952	MicrosoftEdge.exe
4836	MicrosoftEdgeCP.exe
4836	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 4960	916	GameforgeInstaller.exe	75
PID 916 wrote to memory of 4960	916	GameforgeInstaller.exe	75
PID 916 wrote to memory of 4960	916	GameforgeInstaller.exe	75
PID 4960 wrote to memory of 1460	4960	GameforgeLoginSetup.exe	76
PID 4960 wrote to memory of 1460	4960	GameforgeLoginSetup.exe	76
PID 4960 wrote to memory of 1460	4960	GameforgeLoginSetup.exe	76
PID 1460 wrote to memory of 4932	1460	GameforgeLoginSetup.tmp	77
PID 1460 wrote to memory of 4932	1460	GameforgeLoginSetup.tmp	77
PID 1460 wrote to memory of 4932	1460	GameforgeLoginSetup.tmp	77
PID 4932 wrote to memory of 2324	4932	vcredist_x86.exe	79
PID 4932 wrote to memory of 2324	4932	vcredist_x86.exe	79
PID 4932 wrote to memory of 2324	4932	vcredist_x86.exe	79
PID 1460 wrote to memory of 856	1460	GameforgeLoginSetup.tmp	80
PID 1460 wrote to memory of 856	1460	GameforgeLoginSetup.tmp	80
PID 1460 wrote to memory of 856	1460	GameforgeLoginSetup.tmp	80
PID 916 wrote to memory of 2644	916	GameforgeInstaller.exe	82
PID 916 wrote to memory of 2644	916	GameforgeInstaller.exe	82
PID 916 wrote to memory of 2644	916	GameforgeInstaller.exe	82
PID 2644 wrote to memory of 3428	2644	gfclient.exe	87
PID 2644 wrote to memory of 3428	2644	gfclient.exe	87
PID 2644 wrote to memory of 3428	2644	gfclient.exe	87
PID 2644 wrote to memory of 392	2644	gfclient.exe	88
PID 2644 wrote to memory of 392	2644	gfclient.exe	88
PID 2644 wrote to memory of 392	2644	gfclient.exe	88
PID 2644 wrote to memory of 2688	2644	gfclient.exe	89
PID 2644 wrote to memory of 2688	2644	gfclient.exe	89
PID 2644 wrote to memory of 2688	2644	gfclient.exe	89
PID 3740 wrote to memory of 1020	3740	MicrosoftEdgeCP.exe	105
PID 3740 wrote to memory of 1020	3740	MicrosoftEdgeCP.exe	105
PID 3740 wrote to memory of 1020	3740	MicrosoftEdgeCP.exe	105
PID 3740 wrote to memory of 1020	3740	MicrosoftEdgeCP.exe	105
PID 3740 wrote to memory of 1020	3740	MicrosoftEdgeCP.exe	105
PID 3740 wrote to memory of 1020	3740	MicrosoftEdgeCP.exe	105

C:\Users\Admin\AppData\Local\Temp\GameforgeInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\GameforgeInstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:916
- C:\Users\Admin\AppData\Local\Temp\GameforgeLoginSetup.exe
  C:\Users\Admin\AppData\Local\Temp\GameforgeLoginSetup.exe /VERYSILENT /SUPPRESSMSGBOXES /startedFromGsl /host=328194 /msgId=32774
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Users\Admin\AppData\Local\Temp\is-KVUEN.tmp\GameforgeLoginSetup.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-KVUEN.tmp\GameforgeLoginSetup.tmp" /SL5="$40208,78506937,930304,C:\Users\Admin\AppData\Local\Temp\GameforgeLoginSetup.exe" /VERYSILENT /SUPPRESSMSGBOXES /startedFromGsl /host=328194 /msgId=32774
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1460
  - - C:\Program Files (x86)\GameforgeClient\vcredist_x86.exe
      "C:\Program Files (x86)\GameforgeClient\vcredist_x86.exe" /install /quiet /norestart
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4932
    - - C:\Program Files (x86)\GameforgeClient\vcredist_x86.exe
        
        "C:\Program Files (x86)\GameforgeClient\vcredist_x86.exe" /install /quiet /norestart -burn.unelevated BurnPipe.{10CEAB6E-2DBE-43F9-81E1-5A3ACED87FE5} {FFC730E6-CFF1-40A2-9ECB-E84AF6E9385B} 4932
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2324
  - - C:\Program Files (x86)\GameforgeClient\gfservice.exe
      "C:\Program Files (x86)\GameforgeClient\gfservice.exe" /install
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:856
- C:\Program Files (x86)\GameforgeClient\gfclient.exe
  "C:\Program Files (x86)\GameforgeClient\gfclient.exe" "gfclient://game-login/?game=df8661d6-a76e-417f-82dc-9fada569615e&region=en-US"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Program Files (x86)\GameforgeClient\SparkWebHelper.exe
    "C:/Program Files (x86)/GameforgeClient/SparkWebHelper.exe" --type=gpu-process --field-trial-handle=2916,1636268911052751731,17883260385044252171,131072 --no-sandbox --locales-dir-path="C:/Program Files (x86)/GameforgeClient/resources/locales" --log-file=C:/Users/Admin/AppData/Local/Gameforge4d/GameforgeClient/browser.log --log-severity=info --resources-dir-path="C:/Program Files (x86)/GameforgeClient/resources" --lang=en-US --gpu-preferences=KAAAAAAAAACAAwCAAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=3301614889306268899 --mojo-platform-channel-handle=2924 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3428
- - C:\Program Files (x86)\GameforgeClient\SparkWebHelper.exe
    "C:/Program Files (x86)/GameforgeClient/SparkWebHelper.exe" --type=renderer --no-sandbox --field-trial-handle=2916,1636268911052751731,17883260385044252171,131072 --service-pipe-token=10517492661638493714 --lang=en-US --locales-dir-path="C:/Program Files (x86)/GameforgeClient/resources/locales" --log-file=C:/Users/Admin/AppData/Local/Gameforge4d/GameforgeClient/browser.log --log-severity=info --resources-dir-path="C:/Program Files (x86)/GameforgeClient/resources" --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=10517492661638493714 --renderer-client-id=3 --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:392
- - C:\Program Files (x86)\GameforgeClient\SparkWebHelper.exe
    "C:/Program Files (x86)/GameforgeClient/SparkWebHelper.exe" --type=gpu-process --field-trial-handle=2916,1636268911052751731,17883260385044252171,131072 --disable-gpu-sandbox --use-gl=disabled --no-sandbox --locales-dir-path="C:/Program Files (x86)/GameforgeClient/resources/locales" --log-file=C:/Users/Admin/AppData/Local/Gameforge4d/GameforgeClient/browser.log --log-severity=info --resources-dir-path="C:/Program Files (x86)/GameforgeClient/resources" --lang=en-US --gpu-preferences=KAAAAAAAAACAAwCAAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=8497698815241473845 --mojo-platform-channel-handle=3908 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2688

C:\Program Files (x86)\GameforgeClient\gfservice.exe
"C:\Program Files (x86)\GameforgeClient\gfservice.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3472

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:200

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2352

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:1996

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1840

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1052

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1592

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4188

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1908

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4648

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3196

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4384

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3740

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:1020

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3952

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4716

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4836

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:4140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-datetime-l1-1-0.dll
Size 18KB
SHA256 7d588a5a958e32875d7bd346d1371e6ebfd9d5d2ede47755942badfc9c74e207
MD5 9f3cf9f22836c32d988d7c7e0a977e1b
SHA1 1e7bbd6175bdb04826e60de07aa496493c9b3a3b
SHA512 16c98e6aec67ffe4558c6d3f881301490be5d8a714c1adc6735005613251adb8e1c2cb9b1c0d2504a9a99c61a06b0e30c944ca603fc00fbb18cd20ba1c9bd697
SSDEEP 384:0bW7hWQ57A0GftpBjWwTFg6HPaol9OIVnt:0MXPiwwgH2T
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-debug-l1-1-0.dll
Size 18KB
SHA256 92b947f1d6236f86ed7e105cff19e23c13d1968861426511b775905e1d26b47a
MD5 64978e199a7239d2c911876447a7f05b
SHA1 0048ce6724db08c64441ce6e573676bc8ae94bf9
SHA512 9c64211895473ffc7162b56b0b8e732dec54cf03ea9b9b36fe3cc3339c35fc71fc7173d4e146989db399cb1bcb063079378bb6f778f7d2591cd545550038397c
SSDEEP 384:0XW7hWlwIp68A0GftpBjuy1g6al9OIVnQ:046ib1grC
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-errorhandling-l1-1-0.dll
Size 18KB
SHA256 e207ffc6fef144e5d393e79de75f8f20d223f1ac33a011eeb822d30fa2031046
MD5 9d74d89f2679c0c5ddb35a1ef30bd182
SHA1 22eaed07a6e477a4001f9467b5462cf4cc15cc16
SHA512 725626e961d32398ea5aa120ac0339deeb493fc02ee7ef4d8e586173fdbf768b5cbb1f16f093ae4ecfee87e661170f8f832777640a353df5d651af4a62a2d819
SSDEEP 384:01z0W7hWDwIp68A0GftpBj8g65l9OIVnB:01zJIiqgI3
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-file-l1-1-0.dll
Size 21KB
SHA256 c0e5d482bd93bf71a73c01d0c1ec0722ea3260eba1f4c87e797bae334b5e9870
MD5 d826d27c73d9f2420fb39fbe0745c7f0
SHA1 6e68e239f1a58185c7dad0fcfaac9ecfd2e5726c
SHA512 c49843eb10e4e54c66e0e194dbd29ceab9094bdfe745b6a858cb03e34d73a6326f54804e5e5505deacc87146cbdfba17a0f02e62e76c685bce0cd1ff41962ff4
SSDEEP 384:0JPvVX/W7hWLwIp68A0GftpBjXeg6L4l6UzPp:0JPvVXAAi8gHV
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-file-l1-2-0.dll
Size 18KB
SHA256 3816bbb7dd76d8fc6a7b83a0ed2f61b23dd5fc0843d3308ee077cb725d5c9088
MD5 ec4f2cb68dcf7e96516eb284003be8bb
SHA1 fb9237719b5e21b9db176e41bdf125e6e7c01b11
SHA512 6cbda80c476a9fcf46458cac45229c96dc9df251230531e25088e834cd954db9ff4561e744f76495f9c57a4068b7635c72c6f9ff838436c54142297ee310b236
SSDEEP 384:0sW7hWGwIp68A0GftpBjk2g6PBl5AVgk8g:0h3iVgSeVWg
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-file-l2-1-0.dll
Size 18KB
SHA256 096409422ecd1894e4d6289fd2d1c7490bd83daff0c1e3d16c36c78bd477b895
MD5 b9287eb7bcbfdcec2e8d4198fd266509
SHA1 1375b6ff6121ec140668881f4a0b02f0c517f6c7
SHA512 b86348d3f42d0ff465066a14c281088c73ec5e03efacdaabe27a410b054a8a81b438d7e5d030b0d95f53b07783911b8b8200581d4e0b6f1b3cc79f4aae1d67df
SSDEEP 384:dW7hWkwIp68A0GftpBj/mfg6mTxl6Uz8p:21iBmfgDe
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-handle-l1-1-0.dll
Size 18KB
SHA256 a369ef130749bf8cd9f67055179e6f537f200c060af47493d49473912a95021e
MD5 6a35a52d536e34ba060a19d06b1dac80
SHA1 0494a9cbf898e5babb6e697fc2de04a128d2fc35
SHA512 a8aeb58bcf4b314212c2ab5a8fd3c2edeb97e680f774171d4a79390aa23bb62a414aef0ecd5286ffb68b7ed8f6e713ff1892d6d4cc2cbb67de916c6062e762d9
SSDEEP 384:/W7hW6awIp68A0GftpBjasg67llcEbP7JzYl:AwiAsgQ9lzYl
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-heap-l1-1-0.dll
Size 18KB
SHA256 efc9f0e32bce971900ddf66a1a9e68daa3bfb2099a1ba9f24c6ee82da2cbd6e8
MD5 ee5c2fb7bc23bfd06ff32556cc7c3b4d
SHA1 5d60ebf016219bbec340d353a4fa541fff596d3f
SHA512 5d1b8a130c27d8eb63ca0c836bdf63e76afb311de26ed4f25b073bda843ebfa25e136849e3882822257e3783058f30af818a96764d60821a40329cff4e1badac
SSDEEP 384:0aliW7hW5wIp68A0GftpBjQg6nMl9OIVnZ:0imiOgyCX
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-interlocked-l1-1-0.dll
Size 18KB
SHA256 a272ae4fc60e511f48950b08f106fcdd3bc86831df908ee78d630f1ae921880c
MD5 48a5e206d92f3102256ec65e8d570ee0
SHA1 76024fad398dfa4734afce0cc2e5ac117f090ba6
SHA512 65407da566b571e050c25448be6042e84b0c1c7248422cba00b543af9de425a723b0c7c54c4eb6f534e42b1679a058562d500875ddc4f2b52e6b8e6107b1b575
SSDEEP 384:FlYsF2W7hWewIp68A0GftpBjjUg6plcEbP7Jh:dbiygelh
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-libraryloader-l1-1-0.dll
Size 18KB
SHA256 0bd03e89a539aaa3100e2f7d9a058964730320e55aee1f85be8fd243eea7017a
MD5 e33f52e89dfc376eaf7aa655f260ca76
SHA1 b66e1f934f491544190714966031b6dfd2e349ec
SHA512 95cb889599801ba7fa225b633d0fe25fdcc8b495dee5eba05b15a6e53a8a3643b5defe1a881236c40f4fa4365d6775ece067dbb526afdf2015f4d1355c9dfc57
SSDEEP 384:0lvuBL3BGW7hW0wIp68A0GftpBjrg6EqlCXpfAPw:0sBL3BDpiFg1wPw
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-localization-l1-2-0.dll
Size 20KB
SHA256 f33e6ac5d3e1c4f1d89564fb6aeeac170486c073b67694380755049dbc48eec1
MD5 dbb81fcc74c59490008ee59bffff5a6d
SHA1 edbb465ab3bea3a4df3f05e5a4e816edbe195c3b
SHA512 2847a73e952bd5f2448264e0bfc8dc1dcd37f8b02d6d6f525ef0cb69c8e634fdcc4637876361b22c53244659039ed305c015435834b61eea15015fed45e9c374
SSDEEP 384:0IOMw3zdp3bwjGjue9/0jCRrndbNW7hWVwIp68A0GftpBj9g6ylcEbP7J3:0IOMwBprwjGjue9/0jCRrndbmOiPg9l3
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-memory-l1-1-0.dll
Size 18KB
SHA256 8f3f0fd765a37f48162f0bd00c3047e79b4eda355223bfcbed4d35b51349cfcc
MD5 0ee9e0c830a7534dcfc9be72146796f9
SHA1 cecc860b494135482ae693f8e252301073a98578
SHA512 47161e02f4478464ab45c1e3bf9d244d34613e0e68ebe48511a9a0c4e7f8ddb0c1dfd59707c6968c5d76d5027cd19ef748d1235bf74b976410ea6672a6a4bcaf
SSDEEP 384:epW7hW0wIp68A0GftpBj0Ng6llcEbP7JnKd:rRi6NgalKd
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-namedpipe-l1-1-0.dll
Size 18KB
SHA256 3a20635a223e68418c22858413e8c603aac25723de1cb0f54dd675349ec3213d
MD5 1557093add722d1c5a97c359bfcd0d77
SHA1 a8ce995f00a12a81a13d3ef47ce0834178ed69a4
SHA512 b7acd6882b4d36b52f1e49e4b61ddd025de8503f765b72c94ec5a0d85b6ced513c348f7c4898675728c851a2632ad71c78937cdec9dff994b7b27ed2d85cdddd
SSDEEP 384:0vW7hWkwIp68A0GftpBjZyg6mHPUPlCXpfAPuH:0w1i2gpPUdPk
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-processenvironment-l1-1-0.dll
Size 19KB
SHA256 64742ee0729cbe72555247b0165fae03bea7a6b0147869253dae3bb0072173e8
MD5 2a61e4e21bf255107884b6520af5bbcc
SHA1 884eb1a835bcde4e7fd98134f0be797229f4239a
SHA512 d0ca104904352586bbd3da654125b3df9355fe250938a465e8e900d135cec397f1118fdf54829b076df82b8e45fcd7656c2c7aa33ad3c0af5189f7a55e43f498
SSDEEP 192:0vp5WMuXhWWWO5A9YOCAs/nGfe4pBjS7C8WYyieHaVWQ4SWTqnajGppoCfAP3pnO:0vzW7hWa57A0GftpBjYg6ilCXpfAPZN0
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-processthreads-l1-1-0.dll
Size 20KB
SHA256 02839f3b2bdf6adfc89d2f800cc8acda59a40c3e7ce14ef3026f4c72e202297d
MD5 d5c4b8f7260563f72150a84fe884ee31
SHA1 dae1185359ed25a4974504cd1ceaacde28d4318e
SHA512 09ca23413eecf1df94aa36e53fc6fff0f402f21eda2ef79be6aa087818a5bb82ed98db790a2b5cf4ef91a8f70d8e27f56313bc2054a26872d2cad611c472f0b7
SSDEEP 384:07k1JzNcKSIZW7hWZwIp68A0GftpBj3Ng6g/l5AVgkqZ:0CcKSPqipNg+V8
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-processthreads-l1-1-1.dll
Size 18KB
SHA256 bfa24f94ba095174b82d3657f8ecc689eab8ff380c69b1c9a7e311eb70d66386
MD5 f61b9ecb79cd20fc2e8fce87286cfe43
SHA1 7a48accbe43e156f886f1f2836f74e1043feec59
SHA512 42ab62087bbc9fc9c9003ae96ebb9e9bbfa3db4eb74bd6746da035d53d1002015d8482ecb92620ec65c42b8b2b41d9b0a7793e105b0cf8cb6f713a2bc03241db
SSDEEP 384:0mDfIehW7hW+wIp68A0GftpBjnJTYg67l5AVgk99:0xeKHiVJTYg7VX9
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-profile-l1-1-0.dll
Size 17KB
SHA256 48dceeea29558966c391cda34e5755386c2e7e252ea0a03d8d1f21e3cb370c5b
MD5 a472bd416bdc12668523670360650910
SHA1 831d930ef9917e0dccacd8e7f7fd6f3d90082441
SHA512 166134e6c3403f4437e10afb514a55677481d3b03f7cfdf17917a0bb6fa1f387feae58d7dd5dfbc375eae66d24f10c3163ba5958c22beb6978c0b778c2883b6f
SSDEEP 384:03adW7hWDwIp68A0GftpBj8ng6YlcEbP7JsNE:07ciingbln
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 17KB
SHA256 41c69b545d931045a280f83b2f5fbe0ea18c35ac42dfca54b661b42fe8e4f982
MD5 525a156e0ff61306fd44bf7937cacfae
SHA1 6a9a88317a55c939c0cb9f77256f5c3f961d0562
SHA512 c99147eba45e9561b7a2802b0c15a2df2ac886ce95a95f2980f8bf4d1dff92a69b94f11cd17383b577303f24295b1b7e52b8c80ad26c0bb08862c726b9cd8841
SSDEEP 192:fGj5WMuXhWBAO5A9YOCAs/nGfe4pBjSfCyefWYyieHaVWQ4mWXvqnajY1n+htP7G:fGtW7hWF57A0GftpBjrnVg6klcEbP7J4
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-string-l1-1-0.dll
Size 18KB
SHA256 52c9b061c4c74eeb70019edde2b690c7e9d9744979a3b718d6687b3a83f00def
MD5 e57ec98e69961e45cc7a4e0666d26b7d
SHA1 70462a1d68bf49908fcb7186743a47a1affc5d7d
SHA512 4a450bcbce0eb3f98f78af07673227a55cdf8e7840fa892196cbb8d0f90551b32731f70f171644f8097fda97d57caa4b7430023671b19881764613231a20cdc9
SSDEEP 384:cyMvhW7hWMwIp68A0GftpBjT0i0g6hlcEbP7JI:cyMvK5iN6galI
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-synch-l1-1-0.dll
Size 20KB
SHA256 e7d39dcb79d739ec030e9a4e2165b264a24c400566056e1fda267fdd1a8b36bd
MD5 99572ae21d1c8afe3d02f1124979e911
SHA1 5b17addc80b1406a3eaa615f5e37d92e953a0bb7
SHA512 27ca8149d1f0c625de90a3f4cd4a4930ab0c1362ee10a7131ebfd2a88065c2a34c8ad7fb6d95ce33072146b9309488cbfe122984606d631b99d925e3fc42fcff
SSDEEP 384:Vdv3V0dfpkXc0vVa/W7hWswIp68A0GftpBjuFceg6nlcEbP7JnH:Vdv3VqpkXc0vVaAVioFjgklH
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-synch-l1-2-0.dll
Size 18KB
SHA256 01bb32d692b86ebb39a76893125e0f3aaf957c6e4bd682fb46eac32f6fb65be7
MD5 e4110aa5c8a32b63de2c85e0bc297c54
SHA1 6039680f47750cf56d0c9a1768de815a44b83de7
SHA512 0631ea8224403ca113dff9b17852e92c1fcb2820e4f335b668b12689d2a8f058ba33905692f2fd0f4897f8f766db816747ec95478d854b75a0803d2c899e6d98
SSDEEP 384:FtZ3IW7hWzwIp68A0GftpBjXHg6GTlcEbP7Ji9a:zoiJHgrlD
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-sysinfo-l1-1-0.dll
Size 19KB
SHA256 fb23439a5982e723e8e4ae1a5a35f9bbbfba1e76feb4596668f57093b231da6b
MD5 a13048905fc64cd2103094c871c6d826
SHA1 cebb1a74bd5196a3fe174a20543335074a1b7397
SHA512 e23effc6c17177d07f43955cc8ffa17ed05cc2c0a6430078b37de8536170dc3cb4f8970eba1049b10a789ab5acb423745f9d842dac4d63d5714751186a3f071d
SSDEEP 384:R9UJW7hWLwIp68A0GftpBjv6fcg6DlCXpfAPc:R9USIiVmcg8Pc
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-timezone-l1-1-0.dll
Size 18KB
SHA256 d592b91a087c001f9ea38dc5912a90c78fad3a368879d04fd7e5650ed374c8dc
MD5 00b548bf3eab7a6debce296ee5e877de
SHA1 ae18022eb78c192ac3baee32664b9eb011194772
SHA512 3ba15d9a0f1680c2b182cf04fbbfcb0d4f1b607519c161c590928930ad1b3eba8bd417575a51305b9552f0abf0064c74267336ec09cea709aed9228e4eac799e
SSDEEP 384:JW7hWUwIp68A0GftpBjtSg60TwlcEbP7Jira:SBibSgJElira
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-util-l1-1-0.dll
Size 18KB
SHA256 4f31b2888ca82bd1ff40d71e2d11500456b99940dd469bfb097fcd304676fa38
MD5 96d9965ea02eefeadf1f122dfa724449
SHA1 c6f9eb1babe64b30fb1ff6b74e93db8ac41d1294
SHA512 4018eae1e00899a5bd392c9b4f25561cf03292011f52387edd77058f49bd1b7456570f0108338088e5711bf5d6ba33aeb2c7bcd5d24d2744b173ff75bba0347b
SSDEEP 384:oW7hW+AwIp68A0GftpBjR71g608lCXpfAPy:NJ2i71gOPy
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-conio-l1-1-0.dll
Size 19KB
SHA256 905f86530c56c9b453dd8bd9770440de0f6f35aa84b171de747a04d112e35aad
MD5 032a139ea3cc41f2bb801cd580759a75
SHA1 4d88e10bcc4e75edc83bca578510d53fc827aa1a
SHA512 4f574dfe92e90c7d6f162c0b69dd56c96031790abe15e52121c7e44980bbab86914ee06fc153fa5f3a77c4f1c6e4c24d7044507880a80b587872477708506a50
SSDEEP 384:mjsW7hWNwIp68A0GftpBjTqvg6F599QlCXpfAP+:0h6iQvgm599WP+
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-convert-l1-1-0.dll
Size 22KB
SHA256 e4ccd13d5861e3e28984fc7263d79b580a0bc7bbe0d234ed8f1a69706ef908f3
MD5 94e386a317faa200aa1dc270ce54e5fd
SHA1 e352ced285c04378bc3f6af4b30fa69df70b8974
SHA512 f622d303adecdce6ff88acc779d108556c2fdbe1f4140092d2d637c2fc1aaf651c1798291239e1334aabea702d7d380150922abd4e0122cbfc9c079a64dc0e76
SSDEEP 384:CuyVW7hWr57A0GftpBjt9g67mlCXpfAP24m:l+PiD9gVPDm
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-environment-l1-1-0.dll
Size 18KB
SHA256 2cf24c6aac48261ab04eb616e85dd707417697764f860fc29dd3955dd2c49226
MD5 e8ccecac4f06679b9d5e77333d216ee0
SHA1 377363813d0fc18083bdb0456a66efb6598a763a
SHA512 e37db74e11138639e3bb02270589f977bfd803d450ff098d474ca461fd1fabc8e646a177a2082fd0a901fbe15225c4d352567a561c453f56ad8e0097838b945e
SSDEEP 192:75WMuXhWWbO5A9YOCAs/nGfe4pBjS7kWYyieHaVWQ4SWGoqnajGppoCfAP3unil:1W7hWF57A0GftpBjHg6DolCXpfAP/
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-filesystem-l1-1-0.dll
Size 20KB
SHA256 fcd8b213e2e9962b84d1eec4296bbefdf4465398a235e118be12c878fdc08c05
MD5 42153324a982f848d7a49bb7406125c2
SHA1 f0878690d23ad0c905f0a6ec37e9ea1edb813195
SHA512 1710b3fd90210dd6603f2104de249704cad9d83acdc0c6b96ac24e20c4913679b1e4ee41bb7812d919ba76cadb36f7bd8210ee127325fd9db6b542cf2d0b7f69
SSDEEP 384:xhQTq6nWm5CtW7hWV57A0GftpBjaOlg6ElWlCXpfAPUQ:xhQm6nWm5CGUPivlgJMPUQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-heap-l1-1-0.dll
Size 19KB
SHA256 242cb185643df586a5f55735e8810b8d2b6b095c78be206e42cdaae7665bb2cf
MD5 aad41d33906cfdb31681ce8276648481
SHA1 6367d1990873c5af2f5d05d31ea083fb8b127883
SHA512 43b2cf09fcb13211f5bcab6942050e03dfb9ce36b727727f7c764df3754f332f04dc81f411e55caeecfa676c43dd1e977f29b0042c485babaaad609c239a84a9
SSDEEP 384:S1W7hWm57A0GftpBjoN6Dg6VAlCXpfAP/:SudPiaugxP/
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-locale-l1-1-0.dll
Size 18KB
SHA256 81a7a98e11ae94236f34a82a0d450a1100a9b8e752205248de0037a764b91a07
MD5 bc75b80a80802146e79c383c94542f06
SHA1 7da2020a855ea6c003d905551a28af456e7519c2
SHA512 0b6a8f6809f1a39c90bfe58ef0d05d997be307cb18771ff8fed6539bf7e19ee8cc3bedc44e1c22f34441db9b82a6470d3814fc7465d1ea82fa30d37278a0fe65
SSDEEP 192:AZ5WMuXhWBgO5A9YOCAs/nGfe4pBjSfYPLIDWYyieHaVWQ4mW9qnajuJB0zOk:8W7hWp57A0GftpBjp4g6Sl6UzOk
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-math-l1-1-0.dll
Size 28KB
SHA256 4a88f73cae12080b9a637f76f8ab1b8ac29829817ff03ddd611a25b6981ee573
MD5 1028042a84aefe816280f22a4517dc68
SHA1 b3437beb0e5a6a062678a0b32cea98f3c5e33580
SHA512 1da4a2d152943447950ae5de80360741c8a827647d1568c18b026376645f15cc9b5d1915dbdb43278adeac1423b20d6e1c97f6ad67ce724a0d91ec84c4e5250c
SSDEEP 384:/47isbM4Oe5grykfIgTmLOdW7hWX57A0GftpBjBZdIsg6wi0lCXpfAPOm:A1Mq5grxfInO2OPiIsgffPOm
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-multibyte-l1-1-0.dll
Size 26KB
SHA256 e7238f5e38d3991e9d6219255e8cd951d6dd431402c4b4b295a68bd43efa3d48
MD5 b7e1023ebbf0e5018c58b5488c03a643
SHA1 b10d3a570d4a44b87480d015aac4d04ef3f0a355
SHA512 c5536416aeba4b37931e2961a29ea4c8679f6d942289325c9067d46b36797e404c0d8dfd01ce997e89bd42a7f084029d2f2d3cd7485b8cec5e66db50ac1df565
SSDEEP 384:2y+Kr6aLPmIHJI6/CpG3t2G3t4odXL7dW7hW557A0GftpBjubg6bRlCXpfAPl7:2ZKrZPmIHJI6l2oPiKgKPl7
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-private-l1-1-0.dll
Size 71KB
SHA256 f8720e9250c5d5aace6918e1f67f6105f2cd08c0cf55633d2b6b28032d904e9a
MD5 538057da2c6ec8b927904346bb808792
SHA1 1156a3d1a653678b9f85aa64ff65bd3c10510b5e
SHA512 228531381ae55e7c1a24cfe36101325cd0b95899f2a125c72e82043f13248236171ad89a497e5b1d6c19a5febb8d2bd38cb43e81fbd753f3088aaee1c1791b7d
SSDEEP 1536:4t2b2De5c4bFX2Jy2cvxXWpD9d3334BkZnkPBQbrGk:4w2De5c4bFX2Jy2cvxXWpD9d3334BkZj
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-process-l1-1-0.dll
Size 19KB
SHA256 ecc116471ccfa09c599d389d71a574ebed01260b9760021a40665c4d8a22257d
MD5 4aa747ecc612240d522c23b51a8be7c1
SHA1 b037be0bc321e9329c7cf0dbf609fdb9b2d82fb4
SHA512 fb8c0d4f661fe6c8ce6cd04a3c0661a2f0b6058223edbfea811891aedd343d006c22a8524bf8508c2cc396853252477d5cf3c520889650a24d661f4964bce5c9
SSDEEP 384:rKsW7hWywIp68A0GftpBjv6oEg6fwqtlcEbP7JK:Y/isoEgnq1lK
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-runtime-l1-1-0.dll
Size 22KB
SHA256 24bc147f7c8a2dfcbe9296d83ce75a1f2c02076d8f6e6c81f6032c927ed5888a
MD5 2f10f2255271b09d58af75f58476899c
SHA1 ca37f8e4c99fb178e718e99eed286d1ef32b00fc
SHA512 74d85f5a40bd22eb9c85973bda5e596c3688096dc78fb6984f84ded4757ae82d77894c4cae0f24de77d211bbd869f9a4120a104d7c2ed161b4bb7b8568cf5103
SSDEEP 192:R0CjfhrpIhhf4AN5/jip5WMuXhWBjO5A9YOCAs/nGfe4pBjSfUFWYyieHaVWQ4mn:Rb7hrKYW7hWs57A0GftpBjB/g6Zl6UzJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-stdio-l1-1-0.dll
Size 24KB
SHA256 5a3d9a0a2c1f9b14cb52d9cce92b761ec1fe0460ea7d994179c96648455ead84
MD5 65fe48962755451a1a5bab26e6fd978d
SHA1 d1322c477fe4ff61eedf9433b8deddee27f5adb9
SHA512 940269af2c3a8b5b43ca936df1bb5338ae5166f04c34a163b5938895d19bdd7eadc156add1b96b5508e06088419a7d8f466f40bf01e64b4c547fbc1b20328ed7
SSDEEP 384:DUFVhzW7hWhwIp68A0GftpBjq+G+g6eVZl6Uz0yE:gmWinG+g3VpQj
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-string-l1-1-0.dll
Size 24KB
SHA256 d51dfd972e6df5e8185dce0b4eb26dccb0527c5f1c63bc081677335f69b92b67
MD5 a3eccd7f2f2c45d1553055593278645a
SHA1 23cd6aed1b198ca515d7adb213efae780fbf0537
SHA512 1dbf60f5df95e72b98b72faccb52f83585bc0bc5b1f65c259e8568d812461b738bb37c96e72e2f272370788cc7dcd7a8e5a698d9fb2c773ce0e17978c19ef858
SSDEEP 768:B6S5yguNvZ5VQgx3SbwA71IkFbZPirgpVo:Bl5yguNvZ5VQgx3SbwA71IsZbpK
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-time-l1-1-0.dll
Size 20KB
SHA256 d5e2fb8495bbbfb66b2612cd5179c1a5f4746dcdd043ecd474363ffe4a8deb4f
MD5 c8f1a3b19e5103751202010805bce5c9
SHA1 179cf585ce939d05f9610d4b684e4dda6f452f76
SHA512 879fbe66e5440cbe01bd1814a36345fce6454196c8457969d2ee9e93b749df91d0d95b1da1d368063b7ef2a3ed538449b456eb2c7507a27de60105a0d37dcb71
SSDEEP 384:zDW7hWiwIp68A0GftpBjcp+g69xlcEbP7JRR:Avihg+hl3
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-utility-l1-1-0.dll
Size 18KB
SHA256 4eca5b9e5be5750b0bc03fd74b6d5e351cb6d70fd63d5f740a1a122f906390e0
MD5 e0aeba2d9d9ae584d6c1aa0f5929526b
SHA1 3f97b977d8877398d350b373fd441867167bd2ba
SHA512 cfa02a7afa052c5149a741500063f110462d272af417c33bedeac6ad3af424b181144c8045adc04a44a54dffca4639ae3c135f23d64bcfb66f7d3aa980143799
SSDEEP 192:ZfHQdud5WMuXhWBPO5A9YOCAs/nGfe4pBjSfEWLlhWYyieHaVWQ4mWnqnajuJB08:ZfRW7hWY57A0GftpBjul7g6wl6Uz4
MD5 SHA1 SHA512 SSDEEP

Submit Download

concrt140.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\concrt140.dll
Size 238KB
SHA256 f3093cb216bf8ecc8d869e46d8cda3aaca28a326cb865ccbef329e1b13abc834
MD5 bb7293add679a5688fcdd03f44de4b90
SHA1 4ffb7d8acd1bfec663d99694172c0c8c28a92900
SHA512 ea094064c1454cceec03b4f54ad122be169c8bbfa6eece9b4f58eb6d59cbefa16af3a9b6f04461e438e4c208b6224a69a15c10cca6cf4cd5527cf0fe90052711
SSDEEP 6144:dTOKU/JVSHU3eFBp0xRe1o7qu0NdtB0ria/greG5Ioh812z/vyRAq:VUm1Zu0b0eaI5IkzET
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp140.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\msvcp140.dll
Size 429KB
SHA256 9c1dc36d319382e1501cdeaae36bad5b820ea84393ef6149e377d2fb2fc361a5
MD5 d25c3ff7a4cbbffc7c9fff4f659051ce
SHA1 02fe8d84d7f74c2721ff47d72a6916028c8f2e8a
SHA512 945fe55b43326c95f1eee643d46a53b69a463a88bd149f90e9e193d71b84f4875455d37fd4f06c1307bb2cdbe99c1f6e18cb33c0b8679cd11fea820d7e728065
SSDEEP 12288:vTLNQjAM80l7Vpm8j2NoSpmanEhUgiW6QR7t5s03Ooc8dHkC2esuDPG:vTLNQcMmYpET03Ooc8dHkC2enDO
MD5 SHA1 SHA512 SSDEEP

Submit Download

ucrtbase.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\ucrtbase.dll
Size 899KB
SHA256 dd32570b8183a8b117233333153da29cc8d2ac5b1c868440dd852d9c3f77baf5
MD5 015b30309491a911e75748ad69c9e680
SHA1 2f2243b6ea99689cd54e45b67d9b7d98847f904c
SHA512 51159e407021ce78ad64ea91a5e53f59ee15d6d74b9c2891cd6dd532cae3f1d388198e0cd78648ce067e82fa7f01050b4773d95c5c827439f094b289f0ee0ac8
SSDEEP 24576:0oqW/e7NMe7KtlQzn4pz+xJlEIn3FmcvIZPoy4zUkG:d/ehF54pg2
MD5 SHA1 SHA512 SSDEEP

Submit Download

vccorlib140.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\vccorlib140.dll
Size 261KB
SHA256 f3bcc4a3ae6cd03e08ec48411b6927a0a163af6f92384279c1dd7afcb7f52293
MD5 60f11a76e35fd4a9cd2455ea3eff3224
SHA1 c86aa0a9864525b50a87555eb0c42af443b262d2
SHA512 b996e29b9c91bd0a3303a597ecf958648fcafa3d5f0f5a22cc2aebb62714a482023e7a711cb2578f3f8937f802723942717009f98d9432ac7d44918f38fca25d
SSDEEP 3072:994YbM6empMOMfWEZI8O76AhRpG05dPVOxLIt2rHYgmDC2WYs3nOjL2ETrW:n4YbM6+TWoI8Oph/pbeLIt2+PrW
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Program Files (x86)\GameforgeClient\MSVC-CRT\vcruntime140.dll
Size 81KB
SHA256 6823b98c3e922490a2f97f54862d32193900077e49f0360522b19e06e6da24b4
MD5 a2523ea6950e248cbdf18c9ea1a844f6
SHA1 549c8c2a96605f90d79a872be73efb5d40965444
SHA512 2141c041b6bdbee9ec10088b9d47df02bf72143eb3619e8652296d617efd77697f4dc8727d11998695768843b4e94a47b1aed2c6fb9f097ffc8a42ca7aaaf66a
SSDEEP 1536:tBYGvQ2+Ub54AE6ZkJrIriwx0AKGsu0g1kq1ecbRMKlB66M5iEBiA:tB7vQ2+a54AE0sAKxQ1ecbRMKlQoE0A
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Program Files (x86)\GameforgeClient\api-ms-win-core-console-l1-1-0.dll
Size 18KB
SHA256 f6bdc8ffd172b44f4d169707d9a457aeef619872661229b8629ee4f15eefff0d
MD5 11e55839fcb3a53bdfed2a27fb7d5e80
SHA1 e585a1ed88696cd310c12f91ffa27f17f354b4f4
SHA512 bec9419e35de03cc145b3c974833f73f1a5082d886de4739351b93bb4cc6c0234efd0e35ad845faba83fa600c4a7d5343eaae949a837d00d5528e6db79438ee4
SSDEEP 192:0IO5WMuXhWWpO5A9YOCAs/nGfe4pBjS7oT13iWYyieHaVWQ4SWJvaqnajnR5fXFy:0BW7hWv57A0GftpBjbxIg6ECl9OIVnO
MD5 SHA1 SHA512 SSDEEP

Submit Download

gameforge_client_api.dll

Path C:\Program Files (x86)\GameforgeClient\gameforge_client_api.dll
Size 267KB
SHA256 f8697a16ae00404b5754f10773da6d13eb2d710a46d450e988f5f44fa5d07ee7
MD5 b2d4bbb374c4ebd72c71196e752f1b06
SHA1 8d8a1228f84dc7b5c16de93199ba5229052f6a06
SHA512 f3c16c986b0c3a1cfcf0e6d52fc9461fc106527e6a25d895815d627dffecc1ad6aa3ec2cc7a2daf89789dbe3140d500dc73bc83e2a31f1094b5bf238cebb5efc
SSDEEP 6144:eWC8P11W374DKbO9rsey8zfOUdcu4hkHGkhaLWXv:eKDKbO9rsJqPdcrhnkha
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-0UHMM.tmp

Path C:\Program Files (x86)\GameforgeClient\is-0UHMM.tmp
Size 277KB
SHA256 8b54dd0b3d4204875af59cd85fcad74cf3d8401419605f08481fb643a46b2a1b
MD5 26158133670581eb145d54b9a0105fa2
SHA1 a321ef1036d81f69422db2a79902df4d4bd58c3b
SHA512 07445cbd3fdd82ffb7cd1c8beb5ea89cdc5ab1c7e4f90ef7f49ed30e34f6ad6345ed7f2e46f91cbe0a7f4cfbb1656dd684360d1e77dae186109b479b420a530f
SSDEEP 6144:gkG/hVFgz97KOHg/soXLvhMTQ9y8DvwopJXOzRzeYCHZwB3UgcgNQr3ts:gRVFYFBHg/7XLY
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-47S0N.tmp

Path C:\Program Files (x86)\GameforgeClient\is-47S0N.tmp
Size 207KB
SHA256 98f18e42864b31ecf786a0df5518744c40022bbb9054b166251f4d1d6a2cee74
MD5 e1c5c2faabd7de5bbc7bd41772bc882c
SHA1 6692a66323a8e9be9a1bd60c16ca4dd54254f04f
SHA512 5588e1e8541c7cce0fc2945105d965b8bd2f1cc54d254702c4b9a142e7734ddf694d3b0dd120f4fa41af7d6e7b67adc131e83c6ee79f55015027cf7ade273f01
SSDEEP 3072:Vajx1FhkbOe/3f+tG0fnSd6lQggcm5OSB5Oq7:YFabOe+tGmnFlQw+5737
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-5I84V.tmp

Path C:\Program Files (x86)\GameforgeClient\is-5I84V.tmp
Size 621KB
SHA256 922940139a56e8df0a4dbe85c32b5b1833bf10d10b970c2ba1cc840a15482faf
MD5 595adc25416f4fbd5c6a4db93c868431
SHA1 8c7fd55ae785189acd209283b8202f13ad0a8517
SHA512 bd380bfd770f9f18b78325a664513c385953993ea711b3d67816d7d73542541d2ec03136da27e4e1363f2044f621e5a5f1f48bf39657fa4832f159d3de6c04c6
SSDEEP 12288:0drVkYUw0fBpt7//qQ7iE9g96tGZ9/oZZa9tr26IIcP4ejQ:0drVIwgtXiEG9srZZa9tS6IvC
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-5QHCR.tmp

Path C:\Program Files (x86)\GameforgeClient\is-5QHCR.tmp
Size 105KB
SHA256 097242c7ac9c685c50f88b316ddd2c21a736d65988ba425f8e45e6b9648cfb79
MD5 663da220765e0e45badf606d4b41697d
SHA1 c56e21e721d9e77d97e9af6c5eeba89016ae3001
SHA512 8802b42fce8eaf71cf3b342d5613185afc0fae0523e78ecfc5c744b4f84d968a5001d9c5ddeb5738e38576e7dec8a6e9a65cc75893d0389da8aca02931ea5a08
SSDEEP 1536:pcflZ7hdHrmrXjxB4r1tWCJxkv6Tv/6tOzFpfzFzUTod7tOm3hs57tOs3hlX:pcjPSrX9+aODfzFYTod5Ot55OWX
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-7CASQ.tmp

Path C:\Program Files (x86)\GameforgeClient\is-7CASQ.tmp
Size 702KB
SHA256 37b301b8bf3dc4dc17286ffea172409c9772ddc34465173f25c170ace03ec0ca
MD5 96bbb048b8ef84531552b70e22ff039c
SHA1 24c23e64dd10b58497a857782916ab3826daef94
SHA512 68184339bcd3d7e266f3bbbc83c20b7dee437b8a57fcf16ed70c5b5a62d2927ce2273806753a448c3da1552c9e1215fecb38aad55691cdfedb503fed6131ba30
SSDEEP 12288:qxHyj2SvjnCFk43fvVIpspvFpHEM6aJ84dbn4DfklXx:qxSj2SvRqfYc9EMb1vx
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-8CV53.tmp

Path C:\Program Files (x86)\GameforgeClient\is-8CV53.tmp
Size 331KB
SHA256 92c68a49d831c781bb483d55bb306ed834515d6a0273364a344df3f71c2c2e79
MD5 4fab2da20a04c2d3c8456bd2545318fe
SHA1 d9e3b81bfc97c597a7672788ebac2cb8bda2144d
SHA512 883a06b8ddaf3d504f74b85ac0128bc270fb3fe3ef1db5dab94fbf5d29f53c213ce7c1a93b13a961d377d71a0e7abd2f7771a4dde00d3955f93736f295530777
SSDEEP 6144:PFuEwWZhF9MMwe8kGhMOU29nuLdrKa90DvWzO7gipb:PFXwWZn9j8kGhMOU29qFr93zOz
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-8K0FU.tmp

Path C:\Program Files (x86)\GameforgeClient\is-8K0FU.tmp
Size 4.1MB
SHA256 597199396418d196b754805dd9a910f183a91d145e1fd57f88a40fdab6844600
MD5 ee3e9ce575195c0b4854503244b4d4c2
SHA1 e6f858aee1ce954d8522b9af3ea3a45d615bcbd7
SHA512 93f463736f338338aba14ad542474b2db51e58cd32ac21f7072f8974c1e0f9445846b99db8b19e76662fe77d8b6c217021fb370f7f0fc0d4fccd540e06db4faa
SSDEEP 49152:qEgKP0Qy3+dsBOWI1PqI5n7gWlSEjIgRQu9NQr3K04MNJ3qIyXxaKKpjmYv+n5uK:qEgKP0qnplTjNRQeNQrfNJ3vcaKK
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-8VL6F.tmp

Path C:\Program Files (x86)\GameforgeClient\is-8VL6F.tmp
Size 4.9MB
SHA256 84d94018e037ed8824d4a9f8b3fa44f44ece6ea3351db1d21ab1355bc8fbc87a
MD5 be08bf63c8454be5dff48033c39772a4
SHA1 7a64a2cde850d1ed7876762c48d1e65ff266e3e2
SHA512 b6e523ee61a69112e0397f1c4157eb29f983827b0cda1e89350d8ff0d703670daec9dbaf49bceff5b039320865e8d1b576c827dc445a1848fc1069f3636fed00
SSDEEP 98304:9pKCoYkmLXqxD3QvEJsv6tWKFdu9CivD74SQ:/SjQ27QvEJsv6tWKFdu9Ci77a
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-9QVKS.tmp

Path C:\Program Files (x86)\GameforgeClient\is-9QVKS.tmp
Size 359KB
SHA256 dad90c15ee8c8e682c84f334297b5209b0e7a1e94a8f5e07821905173c3b8b17
MD5 acc5b60f94aa02324d3b2594c0cc7460
SHA1 73884463f9e4347bcc42029e2580a8afbf4bfffd
SHA512 253161503783ba0c08225dcd2716058ad57981eb68b75200f790b92ce78b473292bf34e1946760e10b08e19a58ca190fb592424377c49d04b8b2e59be82ab9e5
SSDEEP 6144:JuGN2KVm5KONJg/PlqIyKC1BimrID77+zj8m4rplKfz3k6z0B1jLBlUNEOfn0Unu:JuG4qm5KMJg/YIyKC1smrID77Yj8m4r9
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-9UJBF.tmp

Path C:\Program Files (x86)\GameforgeClient\is-9UJBF.tmp
Size 4.2MB
SHA256 f6eebd31394e23a729f5a1f5fbcb693a30119ca5fdff56887ec5f47cc22c84b4
MD5 3c6fd43e8e5960bc77ae52124095656f
SHA1 fe8301de6a24886d790d7518972b179510701b75
SHA512 cd1f490b436d30d2578997c6a5db06d56a75dc91af41f9e1d2fd5a1052d4454b1f1451b6d7317621a1055eb11ee2c442a0f4f1aeb330c1ce1b7bae7e6cf4acf5
SSDEEP 98304:KhGSdoIE58oo51cf0OXYp0ew/bBzEg3eC:KJdXmsOlzEMeC
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-BEKQN.tmp

Path C:\Program Files (x86)\GameforgeClient\is-BEKQN.tmp
Size 245KB
SHA256 5e8ed66e25d70b1b933a3afb48b741b94aac680140b686c69f1d7bc7701e0a98
MD5 8ad365be3c1fe44cafac93404dd1e097
SHA1 544d212359b13b84333b1166a2e19bcc4ee9c44d
SHA512 deba7af335ecd5bd0cf60a963309c3d86d812cd9d74560511b0900e25b9c4f85a99210d1edb179e09e3c28b2953f9f372c82016caf1cabcad7be0d9ad0992a59
SSDEEP 3072:HfmiQlpuy+vZF7jfXxyVHv8n9vE0NeguHGJ65O/i5O5+:HkzuyM7jfh4v8n9vE0Negu9Aq++
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-CQRNH.tmp

Path C:\Program Files (x86)\GameforgeClient\is-CQRNH.tmp
Size 5.0MB
SHA256 11c26ac8cdaf842c8d723897569c81675b730418a666b2ae46b4b1a80312ec5d
MD5 4ecedcc841a597e08e51c12f1ff9cf72
SHA1 c81adb7de2c476fb4d2cd01afe360f87e32f9cdb
SHA512 71bee391900bd82ec7d925656be9f8fc89c02be6ec4aa8b883f0f923582183568394e88636fb3b42c2e0fbb75287b7afffb10c219688d43b18f72d60f1c17630
SSDEEP 49152:tsZkKugJHvkiGjWhplXlw4hps5KTcP4fdUA/YNr22+vM7MLvmXVFtYzN+VEIPU33:f0vpGShp5c0T/KkUVTu3
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-FP7HV.tmp

Path C:\Program Files (x86)\GameforgeClient\is-FP7HV.tmp
Size 4.3MB
SHA256 9a4005002668d6a01bc942ca2fa08a50e587e77a946cbde82536b965bb4534ac
MD5 ead5499e9b9317e316bab101d2e83ca1
SHA1 77f2dbb196dd7717f4f0910fc72f1b8f187a8f53
SHA512 22b31530d2179ae1b009fc187fb70fed886a963f7bf8a54e76afd6d354d8a2229761746f34109857da6a6304ea84a0d96c14730fd7c1e3dd939323279cd87b66
SSDEEP 49152:3YRKebh6iG8MbW9l843VJw+R6yOwvPKrjA1mP6hT0ozd99:od6iGcNVJ4yRjae0ozd99
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-HPQH2.tmp

Path C:\Program Files (x86)\GameforgeClient\is-HPQH2.tmp
Size 3.0MB
SHA256 98ec2a6a71d6d299db7e30b06d2bc0a75fadd3492b2d2a38e8a258d67ee904c1
MD5 3add3ee27b6b48480969136f92f80b1d
SHA1 606f8e135498d57fbc2f10f6d82f9606863faa66
SHA512 8c81130838b25eb24e3229f882fe7915c15d6048f0605c3378e71026979a02065bfb1e6b5f95639015d60bf46bccffd6e0515a53c4c10f8813afe770c1732a0f
SSDEEP 49152:rJFaN8dhxnoRX53JurGTtONWlXTg3omSyn8Kccxu/Kq4DBTyiqs9J6cnWpYe:s8gr3l04mSOBdTxe
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-JCQDT.tmp

Path C:\Program Files (x86)\GameforgeClient\is-JCQDT.tmp
Size 347KB
SHA256 73d0235998368836862572ca49962f345e18506eaa54d8e1ca2cbd59a01a3e90
MD5 06e4acbcd6cb1fa1150683236a937757
SHA1 9dc37450527754c291bf1058e83cd31abe7ab90c
SHA512 348e68e87bc1e383d8288a2b3817a6a9a89b37e60bd116312ecf2834daee181ac877fa93e75d7bf24267c6fab35c40dbd863da300aed8d7a04aa74be2970c822
SSDEEP 6144:vcCzSdL9T4yr1SEweomIndVcQL9ZhXTZJkoel7gMbtK7TvSs7796Ng:vcC+T4hEweo9VcQLltJkoOPtK6s7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-KMOT6.tmp

Path C:\Program Files (x86)\GameforgeClient\is-KMOT6.tmp
Size 3.5MB
SHA256 2ad0d4987fc4624566b190e747c9d95038443956ed816abfd1e2d389b5ec0851
MD5 587a415cd5ac2069813adef5f7685021
SHA1 ca0e2fe1922b3cdc9e96e636a73e5c85a838e863
SHA512 0fa0e89ea1c1cb27ac7f621feb484438e378a8f5675eca7a91f24e0569174bd848d470d6b3e237fe6ab27ca1eb1ecc09b5f044e53a6d98bf908e77ac511183e2
SSDEEP 49152:zjmJAksRXmBNgC9ITPPE8WHmy0HRZ+kyOzDJn5c5v5H3pqC23u6q+25omPEyXzjS:zy2Ckrj+kyOv2MJ+6q8kbqS/AF
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-NCPTH.tmp

Path C:\Program Files (x86)\GameforgeClient\is-NCPTH.tmp
Size 88.5MB
SHA256 0ac8102b8042353182bfdaa9260cb645a72fc21bac901e371e5c16a213f6edab
MD5 151810db03e3960cfa1ef1b6d9b1ea1f
SHA1 1f8693ec2edc7cb58e61d33511caeeb46bda1994
SHA512 9ef9bf47cbfd912e71b574e041de54a27434c9d0062462bcc3bbec9127b2ba83a8b5fd71ac8e867ce5f0a7363539ba3bb5ca98d8a0ae9d0fabcc1a77ced53d51
SSDEEP 1572864:WbnAUk823htIo6lCzmVGYjrdlRbcwX93Prn1IwSgMstF8:WDk6lL/tjnLMsP
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-OOVDG.tmp

Path C:\Program Files (x86)\GameforgeClient\is-OOVDG.tmp
Size 385KB
SHA256 fcd0e0e215c63986550d96988eab2af5acdb32bceb3503444a7d853417861c14
MD5 a02e7ae49b343a329c963df868cbe4c6
SHA1 2957a7164856f357f29e8b3606fea63bce3496d3
SHA512 a31cf38d5f250853fc15842e8c240daf5c33a13fef70c2b42a2a7f8c4dabd54bb3825d47f80c7366b33792140d821516fb69c71d844a39fa66d78e6999cfc263
SSDEEP 6144:btyfafcrAI3WUhNaVMQjMSZQPFxRNsehSgTuZ:I8cFNa2Qj1QPXi
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-RC8GG.tmp

Path C:\Program Files (x86)\GameforgeClient\is-RC8GG.tmp
Size 2.0MB
SHA256 2f23182ec6f4889397ac4bf03d62536136c5bdba825c7d2c4ef08c827f3a8a1c
MD5 1c9b45e87528b8bb8cfa884ea0099a85
SHA1 98be17e1d324790a5b206e1ea1cc4e64fbe21240
SHA512 b76d780810e8617b80331b4ad56e9c753652af2e55b66795f7a7d67d6afcec5ef00d120d9b2c64126309076d8169239a721ae8b34784b639b3a3e2bf50d6ee34
SSDEEP 49152:DpX9JVeE9HP6Zpy9KyhMI50Du8LljslNsHSHFUq9OiapbbO5Akb:H3P9HP6Zpy9KyhMI50Du8LljslNsyHiS
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-TH0FA.tmp

Path C:\Program Files (x86)\GameforgeClient\is-TH0FA.tmp
Size 171KB
SHA256 1873cade33e33a221245936b856bc076803784cf7d5dcdd7fcf91a39d5170d3b
MD5 28e8132db81e73094b3c29b22b16b943
SHA1 b777a64b310b3f2a6f420fff322e974fecbf03b9
SHA512 e0f13dca1a238d6a3d8bcdccba7b453eb4815853a66ebde1d599b3f8189209626c829a39fa358cd3a554e0ff422c3e46d92fdd75bd69cb973b3eead3753bdb6b
SSDEEP 3072:ZJ+Ry9ZkXJe+u9Ik/bryVe4twQVF3m/6TZA2p5OUQ5O5V:ZJEy9ZkXJe+uLbmFLVF3m/6TZNDFoI
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-TKFI2.tmp

Path C:\Program Files (x86)\GameforgeClient\is-TKFI2.tmp
Size 1021KB
SHA256 27caebc373f97c5c9332fa02ac0c9e18b8792e99549987cb32333681596cf541
MD5 405895b3481596104bddf4346559c396
SHA1 dbe11e76dd3f298ae3f85312ab892577f6a5ac00
SHA512 95b790a83fdc3c1a5a1b63665b2b6adbbd3039588f01cbe2556cf05cbf67bac2846a3c545ce9134feec41ddf13e1ebeaf4c53c30a91aab04a4c40e63fe138020
SSDEEP 24576:iMeDeUEDzSq6cb4qnibq5pe9qCWeBoKBZ7dv3atx:iMmeUEDzSqnpeXoGb0
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-VKMHE.tmp

Path C:\Program Files (x86)\GameforgeClient\is-VKMHE.tmp
Size 288KB
SHA256 e1e54c40204fb63c30716be9613814d930b6a1b705076a0b047a0dab938ba096
MD5 3d80e5030bb5e702f33879714f78888d
SHA1 a42c531413bb6eb2f341b86016dcd325f98d355d
SHA512 0463ef3e9ed243ce40701e331f50666462deed421b48f25996ad43f94bf33dca04cf0103e2d7462cf6870cd1b1b48da980c660295b2b60acb5dbacad976406a3
SSDEEP 6144:ds8IMLzhskcWaMsxNF0io6Tz8NvahgbF5vTMD3/IVgsbZsUJLUx1B/wukcSFIyP7:ds8IMLzhskcWaVxNaio6n8NvahgbFtTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

libEGL.dll

Path C:\Program Files (x86)\GameforgeClient\libEGL.dll
Size 104KB
SHA256 0d0d08b0d8d875aaafbe8daff496bf15be582d9c1efa2d89856f5f3a82e4873b
MD5 6fced98e1a9c384341aef562549663c6
SHA1 6cbbbd5f330d8517bb391c6f6cbf2ab2de82c575
SHA512 2bd8ac5b5b4d089cbfd454550b075b40dd6ab9a6fca228c7b4c2ac5096dce5145dc634ca3362fd6e4635898e14c1bc90f9eea943ebe545c70c82349e2a71405a
SSDEEP 3072:wfEiseZ0hRTqXQIGD6trOwHs5OyUm5O5Tf:wfxs1hbS30XU+Qf
MD5 SHA1 SHA512 SSDEEP

Submit Download

libeay32.dll

Path C:\Program Files (x86)\GameforgeClient\libeay32.dll
Size 1.2MB
SHA256 dbccbeb4b47f6817c8b62c73343aa65071ce5313e128cac40c4d6a8900e68a05
MD5 c83eca4dcffc06caef29a10be5779c89
SHA1 a8fac80942ae8c21126bb6ae4ba0db7602a3edfd
SHA512 8b5921ab9d482ec25e9c9d47ed2ea98941641530a6514041186cd96814ff47e3cb88646df00dc32a0fca83c9bb3b3ba93ece5b18e1f8d555e382cd4b61dc0db1
SSDEEP 24576:mZFFAN8Ye+g7nznOt81xHys7iXgXYBGg+q3itPzqY4xx5TY5NHb5:4g5e+DQxHyXzBGgr3itPzqv5TkNHb5
MD5 SHA1 SHA512 SSDEEP

Submit Download

qtservice.dll

Path C:\Program Files (x86)\GameforgeClient\qtservice.dll
Size 61KB
SHA256 c0326206ecc8a3515a7d7b34a2a8be14f0a6386268a5a44e2fba359f447f0e30
MD5 ef552eecebe73821861c2910a806ec1a
SHA1 ae246a7fb6cff282ffa9d89ca005284bff200851
SHA512 bc16d56eba3fc1246cbbbd3850f4f473a7610b69f65c89442e94de1aef02e0fda46d39f730d22be815399cd9aaf901cd150885e98ad9454d716e747a56b743ec
SSDEEP 1536:1/p+C1v+SYs6hqbDkmUfxO7C5Z4Ugs7tOyI3hkM7tO/3heb:pp+uNb5aOuZTJ5OyLM5OQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

client_en_US.qm

Path C:\Program Files (x86)\GameforgeClient\translations\client_en_US.qm
Size 75KB
SHA256 cff0c8e52a96bd2b39bb010f27bdae8dd4fe9abc57198c04b4fc4f1f932afc3c
MD5 db521b7139228c38ecc4e248aa9c3739
SHA1 a64d27f8c701bf725dd3c3dbb1841addb9a1fb6a
SHA512 364cfb2fb35eb44509f96340839851ac607098275289f6e98f2e2fd644f3a9f073ef07374fce6c010531517eb6a514f4b012dc6a12420ef5d4f707bac9f1708f
SSDEEP 768:J6olokj4aYvq8/LDlg/dphoGiSKquhn3DDtzqdUzpJmTkMRpwxhRKdcNXR:JwkBF8/LDkjLiSKhDDtzqd61RaKB
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist_x86.exe

Path C:\Program Files (x86)\GameforgeClient\vcredist_x86.exe
Size 13.8MB
SHA256 12a69af8623d70026690ba14139bf3793cc76c865759cad301b207c1793063ed
MD5 a3cb49daa1347ffe34b517f1a12f40ab
SHA1 72211bd2e7dfc91ea7c8fac549c49c0543ba791b
SHA512 e3d96cc4c822793893fc3831cbe40d7a53ee8eca3a73021aea2193bbf5c5a05ef5fa4a9fc314c29ad5392f980997a25507caa9cf3a1e3362674ac913fbaebb17
SSDEEP 393216:ZLglp+dkBSuF2SfUfn67qekA7fVswBCElX2cI:Cp+Ty2SfUfnkTIInI
MD5 SHA1 SHA512 SSDEEP

Submit Download

xdelta3.exe

Path C:\Program Files (x86)\GameforgeClient\xdelta3.exe
Size 238KB
SHA256 7a8447f6e4ee96a8188e4d34b8d02e531f34e52fb4cd2bec4c0f9af605a627fa
MD5 35d1b358081e20204c8beb1993434a49
SHA1 84223a2fc83db0768fe642623aef730926cc07e6
SHA512 da9d57f95bcb4741bee1f2d0caa23269f1825f3eb5ad79d40b6c3ef1d48269950ac2d749b16d58cada4da1c6cb198ce019ffc6b1572c0b8d85f2f643031a51f2
SSDEEP 3072:kX41Th4UKFE6WUr2wI+oK/xZzfs6QtdtSg4jtS6mAs2jgXNFA4e49sqRg5KiIq9c:/KFLXr2wXoyxYMDWF2j29qYO+wWV5zL
MD5 SHA1 SHA512 SSDEEP

Submit Download

session.json

Path C:\Users\Admin\AppData\Local\Gameforge4d\GameforgeClient\crashes\gfClient\78c5488a-f6f4-4513-f1d3-bb0098d8df8d.run\session.json
Size 223B
SHA256 456f4a0033dc2e2a63f09500933decbff6d4738293a697e2ad4d4b9c57abce73
MD5 83fa5fadfb9fee007780c845669b27d5
SHA1 6bedaa0ed76095636941b697aa49c7b87444fd99
SHA512 259ff25b9a1ca887a6f00a31932b38375f78748536b7d63b66c274153fb47390ebbc9b98322ca96612cfde1dd65431e1a74122b536f2a3de5550765fea099542
MD5 SHA1 SHA512

Submit Download

session.json

Path C:\Users\Admin\AppData\Local\Gameforge4d\GameforgeClient\crashes\gfClient\78c5488a-f6f4-4513-f1d3-bb0098d8df8d.run\session.json
Size 219B
SHA256 5fa5d8c57e97900ffbe95daf8a94943695dda1af9798408d4bab5b27e10491fe
MD5 d6169997607d3fe544980c7d2a2ec40b
SHA1 1a99a943ed2d0072f728b64d5b3981f7f3fa85b9
SHA512 0f78c96f1318affa4edc9c5ed7556f42dccadc7f93cb645e6d451878592df5033d73595cd2033c0a999160618326ce44360c0bf5de2d22a91fbd83bddfe365a9
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Gameforge4d\GameforgeClient\webcache\Cache\f_000002
Size 23KB
SHA256 5b718ed7b0e10e2b2aeab97adea15ec6f8cded33ca402e194c3585578f3d76d6
MD5 a66b2894043ce8f3fe55446f79d79260
SHA1 4ddeee46fb5e5dda2cc91d7e89471ffbaded1350
SHA512 563639be21d6347d94b9cf9a7260fcf7b091610f24154c0f63c12dcc3380f9af3bb135796f3916a3fbb8d98e22923d8942023a71e70ce7c457d1045581d131ac
SSDEEP 384:rPBOAXXTHHwAhCzMgraIGV0F5TAJQ/vp+Ec925DbiHPo1EjnGXuoUG:bBOAXDnQ9r9FAJQ/vcEckiHh02G
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Gameforge4d\GameforgeClient\webcache\Code Cache\js\index-dir\temp-index
Size 192B
SHA256 5b4866b349342081f4979820ba4589b6a5ac74f0626cb7e0c5b32e8d2420892b
MD5 092cafe454e06fe07c91f718d60d0c86
SHA1 86014303daadc3b2bb2e5143fecb401f754c9d95
SHA512 3b76d872e8af8477902753fba5a976e0886f0260351cd245e0f4e1397b2bc228f12febf33b8bccefa041ae05958f4b7b2bc547417cbac541d36c2901ca17df21
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe585ce0.TMP

Path C:\Users\Admin\AppData\Local\Gameforge4d\GameforgeClient\webcache\Code Cache\js\index-dir\the-real-index~RFe585ce0.TMP
Size 48B
SHA256 c64a77a2287b3e0c5040c9acd431d3b0dc6440c13740e2b07292a7fefed9fb0d
MD5 76dfd3add69871f308d8f49a3a31a86c
SHA1 1b50043e38a1a808508717c3c8a3fcf8d7b50269
SHA512 f4a705321ae46bf8bd793f4396abf18c0011a4c6c81c3b05f9c6d7b002f7cd3d4bfe64c9d3bef76ec9595bf0b85973d64b7946c8b3500b75b6a999ef0b9fd1a7
MD5 SHA1 SHA512

Submit Download

favicon[1].htm

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\PEPIZDB9\favicon[1].htm
Size 64KB
SHA256 a6f416b8b4546a5c2209c19cbf9b77d4bf63b61d550760f3d73a996f68c2cc79
MD5 eb24ccacf5effd34bc10e1e6e98f07c0
SHA1 efad032ca75dd85febc9715b1098fa98054563da
SHA512 480e9f86f9b5cd3ca05e5ed4b5e96aea5929d620e13f83f236c5a10ad98408d5c8c7338eea3e256f21a34af11cd1bcb1703137fc45d0a78ebf6860ed0df040c4
SSDEEP 768:TxPd6ocUxPiUpb4FwA6V6xcQ8zNahaG70qYSM0EhsSNN4/c4zzCuXw:CwawZw8KlE+S/D
MD5 SHA1 SHA512 SSDEEP

Submit Download

edb.log

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log
Size 512KB
SHA256 c1b6f8e5aea1cee165c955f2a2d25085224d70142c511a108d1004f6c68b5302
MD5 f8d9524192f68d21de6cea8fee152085
SHA1 5a35f415831833c458eadbad44d4276ece25332d
SHA512 20a22b9a5c1de759f32b743114101c7dfa4ef6f45e608677f99150c22c7519ffb92593aafd87870f2ff6375c420dd9673a5e029a637bbe4739d6da512c8d8599
SSDEEP 1536:c0gPdfVxkZm3l4f49AynP0ga04OeAu01g5NtRZDZTUgzbxDWLM1w+KjIzQY0JCai:c0gPdAfSZeVRJJbe+KjIzQY6GsTs
MD5 SHA1 SHA512 SSDEEP

Submit Download

~DFFC810FA32092618B.TMP

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFFC810FA32092618B.TMP
Size 16KB
SHA256 4a8b2056c7cd29f16e1a2357d767ea9ddd65f64376749cb9aadc6b368673ee7f
MD5 bbdffc009eadb5d63504e6aaf851def8
SHA1 ec8c569f34e511e7126e18c8f791ec4bf5e4f1bd
SHA512 c45161ce10403bc306e6d5f11404990fed27dd45c525bc8218d73093f4e1f53a0dea42ee7907dbdc1975da93a58b68cc2f9703cf9923b5b62ede0a7393b66376
SSDEEP 12:i9lCqSYYC4qGnDqBc7rYrIOkVl69QSS3w5Q1:i9lEA0Dq2XHPm9Cw5Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

GameforgeLoginSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\GameforgeLoginSetup.exe
Size 75.8MB
SHA256 350c12d6959d892c501a92b86b62f0846afcd60a57c203ed0d9be0f350ff46a0
MD5 abd63170f519a1de1e1154422ec028dd
SHA1 f5dd1a0f3cab5a710936c9a99fa9f682db2073ce
SHA512 a72bc7b97f26f7cb9aaacb5455cab5b1c43519cd7e8e80ce02956c67f32a82d14aca763f68c138c67db6ac1e26ae2ce82c471d47e6cd7cc925e6bd98950b14b7
SSDEEP 1572864:5sLY+K0qN+LK2Vw0ztA+V9+BqCci1foWsuz1n+STPz+1AunWUz4tMw1VlpuUuK:FuqNaNPz94ECHfdP+S7zQNWy4thS6
MD5 SHA1 SHA512 SSDEEP

Submit Download

GameforgeLoginSetup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-KVUEN.tmp\GameforgeLoginSetup.tmp
Size 2.6MB
SHA256 9d8458625087bfc99af6b748b9d5928852cdf2521d339c44f1ec7e2a8d613579
MD5 978e1c2a61aa0730b7a0030b38858793
SHA1 f199e78154bf3d8fe79b67aa0a9836cb912500bb
SHA512 4ff5ea2a9601569686b1b4b90d60a22cb350b0db0d5b47fb762c7de1e6bb17af100bb06f07fe20b0be8748dbe673d681734e59f779ab3f0df7b2f89f84e999fe
SSDEEP 49152:cg2qPtc1e5OS7bPGoUl+x/grN4azvchYk2JciLrI:cvqPCnrN4azvSYB5E
MD5 SHA1 SHA512 SSDEEP

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
MD5 SHA1 SHA512

Submit Download

session.json

Path C:\Windows\Temp\Gameforge4d\GameforgeService\crashes\37651c67-c158-4380-dd95-bdf840e7f0a6.run\session.json
Size 223B
SHA256 4e1f5ff053d66bfb0d26ddb83183aba40c96bca7a7c7116e9ca2d1b9821d7b56
MD5 7c29488fa1c804cac67dfd3d7045e348
SHA1 4b89fa1da0854bab176ba50b474146e787eb73e7
SHA512 855f129c59ce262950d340a3c6d56982e9d79e92d8f929dd052de3a9397fb99f7849c46e18e938c3d9f7af4e8e6b016b65ed73756421964f659d44ba73799d99
MD5 SHA1 SHA512

Submit Download

session.json

Path C:\Windows\Temp\Gameforge4d\GameforgeService\crashes\37651c67-c158-4380-dd95-bdf840e7f0a6.run\session.json
Size 219B
SHA256 0e3b6f286d9e067b0ab037a05b319c86ecfa66ff293d9a30cc0392fb78dee17b
MD5 87e85e109faa20a7a9836b856b8da4fb
SHA1 a633b0f737ce6c281d592b60cef79ace2a795e4e
SHA512 9dd44408ead63c3461f09ad89a33a8dc5ed0216d091e119d24c3ee0261691d897961bc0748353f6d9aab5fe32721a5b8ddfa5761113959ecc941b729bb167f29
MD5 SHA1 SHA512

Submit Download

qwindows.dll

Path \Program Files (x86)\GameforgeClient\platforms\qwindows.dll
Size 1.1MB
SHA256 7fffdbc486e0310922bae73a2a1246a9c16aae3ba273c5d1bc4f2827c8272930
MD5 a91f18a844fc6cfa8064546b03223347
SHA1 19926bc68a92532aa46abedc8ec1c887e41d06b0
SHA512 2c04530fa6a9e0aa25b83de52557b33789d623c8558193d7177074a3416e6e0dc2e7a494e0ba860add0a0326226401612af50a636f786a84fc5286dfa4d541eb
SSDEEP 24576:dWMfEhIR8kW5SPZsd/lgWWJWCbJbmWnl0oZ:4/fSPOfglJPNRnl0
MD5 SHA1 SHA512 SSDEEP

Submit Download

qwindowsvistastyle.dll

Path \Program Files (x86)\GameforgeClient\styles\qwindowsvistastyle.dll
Size 121KB
SHA256 75e27daea42c488b79bd00d3ce321a41ff4184c1a62802e55b0d97f8343b7989
MD5 00340ca804e682eecb8ea5b8e4057575
SHA1 5d75d3d30a2aaff2c3ff90ecd0c772c47f57d4b5
SHA512 0c09845050df26f0a1ec6b1ff07b5fa8dade871aa39045ea59e16f209ac36053bdd22905b7c8fec7484f0a566db42c979a8f08124bb403da8b0ef2e1b722b27e
SSDEEP 3072:Fd7Bp8C42JRwPhCqqPlzL/AY4lfcmou7+a1AL1AWsMD7bcI0aRHZ/lJPX5VtX/jH:38SJR8OlzBja1AoMD7bcRaRHZ/lJPX5D
MD5 SHA1 SHA512 SSDEEP

Submit Download

wixstdba.dll

Path \Users\Admin\AppData\Local\Temp\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\wixstdba.dll
Size 118KB
SHA256 a9295ad4e909f979e2b6cb2b2495c3d35c8517e689cd64a918c690e17b49078b
MD5 4d20a950a3571d11236482754b4a8e76
SHA1 e68bd784ac143e206d52ecaf54a7e3b8d4d75c9c
SHA512 8b9243d1f9edbcbd6bdaf6874dc69c806bb29e909bd733781fde8ac80ca3fff574d786ca903871d1e856e73fd58403bebb58c9f23083ea7cd749ba3e890af3d2
SSDEEP 1536:nw7WzpopAuJhsVuThs5cXyeM6JUOfPGSpeBxm946ITADDwYkH/1d9chyP7iN6p:pmAuJhAyZFpem90iw//1d9chwG6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/200-998-0x0000018E9A620000-0x0000018E9A630000-memory.dmp

Download

memory/200-1033-0x0000018E9A870000-0x0000018E9A872000-memory.dmp

Download

memory/200-1014-0x0000018E9AA00000-0x0000018E9AA10000-memory.dmp

Download

memory/1052-1067-0x000001739DE90000-0x000001739DEB0000-memory.dmp

Download

memory/1460-12-0x00000000007C0000-0x00000000007C1000-memory.dmp

Download

memory/1460-850-0x0000000000400000-0x00000000006AC000-memory.dmp

Download

memory/1460-181-0x00000000007C0000-0x00000000007C1000-memory.dmp

Download

memory/1460-113-0x0000000000400000-0x00000000006AC000-memory.dmp

Download

memory/1460-170-0x0000000000400000-0x00000000006AC000-memory.dmp

Download

memory/2644-987-0x0000000004050000-0x0000000004060000-memory.dmp

Download

memory/2644-897-0x0000000004050000-0x0000000004060000-memory.dmp

Download

memory/2644-1341-0x0000000004050000-0x0000000004060000-memory.dmp

Download

memory/3472-913-0x00000000004A0000-0x00000000004B0000-memory.dmp

Download

memory/4960-6-0x0000000000400000-0x00000000004F1000-memory.dmp

Download

memory/4960-100-0x0000000000400000-0x00000000004F1000-memory.dmp

Download

memory/4960-851-0x0000000000400000-0x00000000004F1000-memory.dmp

Download