Analysis
-
max time kernel
1800s -
max time network
1802s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
15/04/2024, 21:07
Static task
static1
Behavioral task
behavioral1
Sample
LauncherPatcher.exe
Resource
win10-20240404-en
General
-
Target
LauncherPatcher.exe
-
Size
963KB
-
MD5
e52ca3fa296efdea5da3ea287e0b807e
-
SHA1
bb2de49d1e284d3b5e6e4e41512caba8bfeeeb70
-
SHA256
e86d052b13aad94e385fdaa37d1392a017fcec41dd748a5f887c73bc6aac0a62
-
SHA512
65f11c372b7c0b2a1beb792f0e8daaa239ca22abfafa6e041510d35fc092d3f3632c43af620e14d736c84672ee69d32e8be9feb25d035c9fa3ffd55c846cf4b8
-
SSDEEP
12288:gJQRuN+AsYRXE0MQp7llRkIA9cbyeE/L3mkyBe88+fBAFWFuYWWBNDT49Z5oZyxI:gORe+A13lYouYjBNP4L5/I
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000700000001ac3d-149.dat acprotect behavioral1/memory/4508-152-0x0000000072B80000-0x0000000072B89000-memory.dmp acprotect -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-81807878-2351072935-4259904108-1000\Control Panel\International\Geo\Nation SocialClubHelper.exe Key value queried \REGISTRY\USER\S-1-5-21-81807878-2351072935-4259904108-1000\Control Panel\International\Geo\Nation SocialClubHelper.exe Key value queried \REGISTRY\USER\S-1-5-21-81807878-2351072935-4259904108-1000\Control Panel\International\Geo\Nation SocialClubHelper.exe Key value queried \REGISTRY\USER\S-1-5-21-81807878-2351072935-4259904108-1000\Control Panel\International\Geo\Nation SocialClubHelper.exe -
Executes dropped EXE 30 IoCs
pid Process 4508 RockstarGamesLauncherInstaller.exe 4616 vc_redist.x64.exe 3320 vc_redist.x64.exe 4992 vc_redist.x86.exe 4380 vc_redist.x86.exe 4444 RockstarService.exe 3420 RockstarService.exe 4156 RockstarService.exe 3404 LauncherPatcher.exe 804 Launcher.exe 4684 LauncherPatcher.exe 3200 Launcher.exe 3692 RockstarService.exe 4940 RockstarService.exe 3632 RockstarService.exe 2744 Launcher.exe 5104 RockstarErrorHandler.exe 4156 RockstarService.exe 1332 RockstarService.exe 4412 Social-Club-Setup.exe 2252 SocialClubHelper.exe 2616 SocialClubHelper.exe 2584 SocialClubHelper.exe 2568 SocialClubHelper.exe 4552 SocialClubHelper.exe 1312 SocialClubHelper.exe 4288 SocialClubHelper.exe 3432 SocialClubHelper.exe 4360 SocialClubHelper.exe 4836 SocialClubHelper.exe -
Loads dropped DLL 43 IoCs
pid Process 4508 RockstarGamesLauncherInstaller.exe 4508 RockstarGamesLauncherInstaller.exe 4508 RockstarGamesLauncherInstaller.exe 4508 RockstarGamesLauncherInstaller.exe 4508 RockstarGamesLauncherInstaller.exe 4508 RockstarGamesLauncherInstaller.exe 4508 RockstarGamesLauncherInstaller.exe 4508 RockstarGamesLauncherInstaller.exe 4508 RockstarGamesLauncherInstaller.exe 4508 RockstarGamesLauncherInstaller.exe 3320 vc_redist.x64.exe 4380 vc_redist.x86.exe 4508 RockstarGamesLauncherInstaller.exe 4508 RockstarGamesLauncherInstaller.exe 4508 RockstarGamesLauncherInstaller.exe 2744 Launcher.exe 2744 Launcher.exe 2744 Launcher.exe 2252 SocialClubHelper.exe 2252 SocialClubHelper.exe 2616 SocialClubHelper.exe 2616 SocialClubHelper.exe 2616 SocialClubHelper.exe 2616 SocialClubHelper.exe 2616 SocialClubHelper.exe 2568 SocialClubHelper.exe 2568 SocialClubHelper.exe 2584 SocialClubHelper.exe 2616 SocialClubHelper.exe 2584 SocialClubHelper.exe 4552 SocialClubHelper.exe 4552 SocialClubHelper.exe 4288 SocialClubHelper.exe 1312 SocialClubHelper.exe 4288 SocialClubHelper.exe 1312 SocialClubHelper.exe 3432 SocialClubHelper.exe 3432 SocialClubHelper.exe 4360 SocialClubHelper.exe 4360 SocialClubHelper.exe 4836 SocialClubHelper.exe 4836 SocialClubHelper.exe 4836 SocialClubHelper.exe -
Registers COM server for autorun 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32 dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\SYSTEM32\\dxdiagn.dll" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32 dxdiag.exe -
resource yara_rule behavioral1/files/0x000700000001ac3d-149.dat upx behavioral1/memory/4508-152-0x0000000072B80000-0x0000000072B89000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 24 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB RockstarService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5 RockstarService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_1C3770C1FB472ED01DC6B5C78747CAC5 RockstarService.exe File created \??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_82738beb7b514250\keyboard.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_74965e869fab271a\mshdc.PNF dxdiag.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB RockstarService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 RockstarService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_EAF064FC44599326900E60DC50ABB82E RockstarService.exe File created \??\c:\windows\system32\driverstore\filerepository\usbport.inf_amd64_8e5f608c0111283d\usbport.PNF dxdiag.exe File created \??\c:\windows\system32\driverstore\filerepository\input.inf_amd64_e15abe7d25aa2071\input.PNF dxdiag.exe File created \??\c:\windows\system32\driverstore\filerepository\hdaudbus.inf_amd64_e22da3cb2d7a1ed6\hdaudbus.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_e6c89cc58804e205\machine.PNF dxdiag.exe File created \??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_b0ca8be2ac09ed24\msmouse.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_82738beb7b514250\keyboard.PNF dxdiag.exe File created \??\c:\windows\system32\driverstore\filerepository\machine.inf_amd64_e6c89cc58804e205\machine.PNF dxdiag.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5 RockstarService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_1C3770C1FB472ED01DC6B5C78747CAC5 RockstarService.exe File created C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_e15abe7d25aa2071\input.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_b0ca8be2ac09ed24\msmouse.PNF dxdiag.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_EAF064FC44599326900E60DC50ABB82E RockstarService.exe File created C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_8e5f608c0111283d\usbport.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_e22da3cb2d7a1ed6\hdaudbus.PNF dxdiag.exe File created \??\c:\windows\system32\driverstore\filerepository\mshdc.inf_amd64_74965e869fab271a\mshdc.PNF dxdiag.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 RockstarService.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Rockstar Games\Social Club\locales\cs.pak Social-Club-Setup.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\SocialClubD3D12Renderer.dll Social-Club-Setup.exe File opened for modification C:\Program Files (x86)\Rockstar Games\Social Club\libGLESv2.dll Social-Club-Setup.exe File opened for modification C:\Program Files (x86)\Rockstar Games\Social Club\locales\es.pak Social-Club-Setup.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\locales\it.pak Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Launcher\Launcher.exe RockstarGamesLauncherInstaller.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\locales\uk.pak Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Social Club\snapshot_blob.bin Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Social Club\locales\sk.pak Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Social Club\locales\th.pak Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Social Club\SocialClubVulkanLayer.json Social-Club-Setup.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\v8_context_snapshot.bin Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Social Club\vulkan-1.dll Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-string-l1-1-0.dll RockstarGamesLauncherInstaller.exe File created C:\Program Files\Rockstar Games\Launcher\ucrtbase.dll RockstarGamesLauncherInstaller.exe File opened for modification C:\Program Files\Rockstar Games\Launcher\ThirdParty\Steam\steam_api64.dll.swap RockstarService.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\locales\ja.pak Social-Club-Setup.exe File opened for modification C:\Program Files (x86)\Rockstar Games\Social Club\locales\mr.pak Social-Club-Setup.exe File opened for modification C:\Program Files (x86)\Rockstar Games\Social Club\locales\zh-CN.pak Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-interlocked-l1-1-0.dll RockstarGamesLauncherInstaller.exe File created C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-string-l1-1-0.dll RockstarGamesLauncherInstaller.exe File opened for modification C:\Program Files\Rockstar Games\Launcher\RockstarService.exe.swap RockstarService.exe File opened for modification C:\Program Files (x86)\Rockstar Games\Social Club\locales\nl.pak Social-Club-Setup.exe File opened for modification C:\Program Files (x86)\Rockstar Games\Social Club\locales\th.pak Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Social Club\locales\bn.pak Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Social Club\locales\ur.pak Social-Club-Setup.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\locales\ca.pak Social-Club-Setup.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\locales\pt-BR.pak Social-Club-Setup.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\locales\uk.pak Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-rtlsupport-l1-1-0.dll RockstarGamesLauncherInstaller.exe File created C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-runtime-l1-1-0.dll RockstarGamesLauncherInstaller.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\SocialClubVulkanLayer.json Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Social Club\locales\te.pak Social-Club-Setup.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\locales\te.pak Social-Club-Setup.exe File opened for modification C:\Program Files (x86)\Rockstar Games\Social Club\chrome_200_percent.pak Social-Club-Setup.exe File opened for modification C:\Program Files (x86)\Rockstar Games\Social Club\locales\de.pak Social-Club-Setup.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\chrome_200_percent.pak Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Social Club\locales\pt-PT.pak Social-Club-Setup.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\locales\ta.pak Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Social Club\locales\nb.pak Social-Club-Setup.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\locales\nb.pak Social-Club-Setup.exe File opened for modification C:\Program Files (x86)\Rockstar Games\Social Club\locales\es-419.pak Social-Club-Setup.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\locales\nl.pak Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-synch-l1-1-0.dll RockstarGamesLauncherInstaller.exe File created C:\Program Files\Rockstar Games\Social Club\locales\gu.pak Social-Club-Setup.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\vk_swiftshader_icd.json Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Social Club\locales\sl.pak Social-Club-Setup.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\locales\fa.pak Social-Club-Setup.exe File opened for modification C:\Program Files (x86)\Rockstar Games\Social Club\locales\ms.pak Social-Club-Setup.exe File opened for modification C:\Program Files (x86)\Rockstar Games\Social Club\locales\nb.pak Social-Club-Setup.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\socialclub.dll Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Launcher\RockstarSteamHelper.exe RockstarGamesLauncherInstaller.exe File created C:\Program Files\Rockstar Games\Social Club\locales\bg.pak Social-Club-Setup.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\locales\ja.pak Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Social Club\SocialClubVulkanLayer.dll Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Social Club\vk_swiftshader.dll Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Social Club\libGLESv2.dll Social-Club-Setup.exe File opened for modification C:\Program Files\Rockstar Games\Launcher\ThirdParty\Epic\EOSSDK-Win64-Shipping-1.14.2.dll.swap RockstarService.exe File created C:\Program Files\Rockstar Games\Social Club\locales\en-US.pak Social-Club-Setup.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\locales\he.pak Social-Club-Setup.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\locales\el.pak Social-Club-Setup.exe File opened for modification C:\Program Files (x86)\Rockstar Games\Social Club\locales\en-GB.pak Social-Club-Setup.exe File opened for modification C:\Program Files (x86)\Rockstar Games\Social Club\locales\sr.pak Social-Club-Setup.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\setupact.log dxdiag.exe File opened for modification C:\Windows\setuperr.log dxdiag.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs dxdiag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dxdiag.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dxdiag.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs dxdiag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000 dxdiag.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dxdiag.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ Launcher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Launcher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Launcher.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs RockstarService.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates RockstarService.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot RockstarService.exe -
Modifies registry class 57 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\CLSID dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rockstar\shell\open RockstarService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mtl RockstarGamesLauncherInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\ = "DxDiagClassObject Class" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7} dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mtl\ = "URL:mtl Protocol" RockstarGamesLauncherInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mtl\DefaultIcon\ = "\"C:\\Program Files\\Rockstar Games\\Launcher\\Launcher.exe\"" RockstarGamesLauncherInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer\ = "DxDiag.DxDiagClassObject.1" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID\ = "DxDiag.DxDiagClassObject.1" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32 dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\SYSTEM32\\dxdiagn.dll" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\ = "DxDiagProvider Class" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mtl\DefaultIcon RockstarGamesLauncherInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mtl\shell\open RockstarGamesLauncherInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32 dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rockstar\shell\open\command\ = "\"C:\\Program Files\\Rockstar Games\\Launcher\\Launcher.exe\" \"%1\"%*" RockstarService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rockstar\ = "URL:rockstar Protocol" RockstarService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rockstar\DefaultIcon\ = "\"C:\\Program Files\\Rockstar Games\\Launcher\\Launcher.exe\"" RockstarService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rockstar\shell\open\command RockstarService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rockstar\shell RockstarService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rockstar\shell\open\command\ = "\"C:\\Program Files\\Rockstar Games\\Launcher\\Launcher.exe\" \"%1\"" RockstarService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ = "DxDiagClassObject Class" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CLSID dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B} dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mtl\shell\open\command\ = "\"C:\\Program Files\\Rockstar Games\\Launcher\\Launcher.exe\" \"%1\"" RockstarGamesLauncherInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove dxdiag.exe Key created \REGISTRY\USER\S-1-5-21-81807878-2351072935-4259904108-1000_Classes\Extensions\ContractId\Windows.Protocol\PackageId CastSrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rockstar\URL Protocol RockstarService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mtl\shell RockstarGamesLauncherInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\VersionIndependentProgID dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mtl\shell\open\command RockstarGamesLauncherInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1 dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rockstar\shell\open\command RockstarService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mtl\URL Protocol RockstarGamesLauncherInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rockstar\DefaultIcon RockstarService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID\ = "DxDiag.DxDiagClassObject" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\ = "DxDiagClassObject Class" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\ProgID dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mtl\shell\ RockstarGamesLauncherInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\ = "DxDiagProvider Class" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer\ = "DxDiag.DxDiagClassObject.1" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rockstar RockstarService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove\ = "Programmable" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1 dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mtl\shell\open\ RockstarGamesLauncherInstaller.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4508 RockstarGamesLauncherInstaller.exe 4508 RockstarGamesLauncherInstaller.exe 4508 RockstarGamesLauncherInstaller.exe 4508 RockstarGamesLauncherInstaller.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 4940 RockstarService.exe 4940 RockstarService.exe 3200 Launcher.exe 3200 Launcher.exe 3200 Launcher.exe 3200 Launcher.exe 3200 Launcher.exe 3200 Launcher.exe 3200 Launcher.exe 3200 Launcher.exe 3200 Launcher.exe 3200 Launcher.exe 3200 Launcher.exe 3200 Launcher.exe 4816 dxdiag.exe 4816 dxdiag.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 4940 RockstarService.exe 4940 RockstarService.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 4940 RockstarService.exe 4940 RockstarService.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 4940 RockstarService.exe 4940 RockstarService.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 804 Launcher.exe 4940 RockstarService.exe 4940 RockstarService.exe 804 Launcher.exe 804 Launcher.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2744 Launcher.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4508 RockstarGamesLauncherInstaller.exe Token: SeDebugPrivilege 4508 RockstarGamesLauncherInstaller.exe Token: SeTakeOwnershipPrivilege 4940 RockstarService.exe Token: SeTakeOwnershipPrivilege 4940 RockstarService.exe Token: SeTakeOwnershipPrivilege 4940 RockstarService.exe Token: SeTakeOwnershipPrivilege 4940 RockstarService.exe Token: SeTakeOwnershipPrivilege 4940 RockstarService.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe Token: SeCreatePagefilePrivilege 2252 SocialClubHelper.exe Token: SeShutdownPrivilege 2252 SocialClubHelper.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 804 Launcher.exe 804 Launcher.exe 2744 Launcher.exe 2744 Launcher.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 804 Launcher.exe 804 Launcher.exe 2744 Launcher.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 4508 RockstarGamesLauncherInstaller.exe 4508 RockstarGamesLauncherInstaller.exe 4616 vc_redist.x64.exe 3320 vc_redist.x64.exe 4992 vc_redist.x86.exe 4380 vc_redist.x86.exe 4444 RockstarService.exe 3420 RockstarService.exe 4156 RockstarService.exe 804 Launcher.exe 3200 Launcher.exe 4816 dxdiag.exe 2744 Launcher.exe -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 2128 wrote to memory of 4508 2128 LauncherPatcher.exe 73 PID 2128 wrote to memory of 4508 2128 LauncherPatcher.exe 73 PID 2128 wrote to memory of 4508 2128 LauncherPatcher.exe 73 PID 4508 wrote to memory of 4616 4508 RockstarGamesLauncherInstaller.exe 76 PID 4508 wrote to memory of 4616 4508 RockstarGamesLauncherInstaller.exe 76 PID 4508 wrote to memory of 4616 4508 RockstarGamesLauncherInstaller.exe 76 PID 4616 wrote to memory of 3320 4616 vc_redist.x64.exe 77 PID 4616 wrote to memory of 3320 4616 vc_redist.x64.exe 77 PID 4616 wrote to memory of 3320 4616 vc_redist.x64.exe 77 PID 4508 wrote to memory of 4992 4508 RockstarGamesLauncherInstaller.exe 78 PID 4508 wrote to memory of 4992 4508 RockstarGamesLauncherInstaller.exe 78 PID 4508 wrote to memory of 4992 4508 RockstarGamesLauncherInstaller.exe 78 PID 4992 wrote to memory of 4380 4992 vc_redist.x86.exe 79 PID 4992 wrote to memory of 4380 4992 vc_redist.x86.exe 79 PID 4992 wrote to memory of 4380 4992 vc_redist.x86.exe 79 PID 4508 wrote to memory of 4444 4508 RockstarGamesLauncherInstaller.exe 80 PID 4508 wrote to memory of 4444 4508 RockstarGamesLauncherInstaller.exe 80 PID 4508 wrote to memory of 3420 4508 RockstarGamesLauncherInstaller.exe 81 PID 4508 wrote to memory of 3420 4508 RockstarGamesLauncherInstaller.exe 81 PID 4508 wrote to memory of 4156 4508 RockstarGamesLauncherInstaller.exe 82 PID 4508 wrote to memory of 4156 4508 RockstarGamesLauncherInstaller.exe 82 PID 3404 wrote to memory of 804 3404 LauncherPatcher.exe 85 PID 3404 wrote to memory of 804 3404 LauncherPatcher.exe 85 PID 4684 wrote to memory of 3200 4684 LauncherPatcher.exe 89 PID 4684 wrote to memory of 3200 4684 LauncherPatcher.exe 89 PID 804 wrote to memory of 3692 804 Launcher.exe 90 PID 804 wrote to memory of 3692 804 Launcher.exe 90 PID 804 wrote to memory of 4816 804 Launcher.exe 92 PID 804 wrote to memory of 4816 804 Launcher.exe 92 PID 804 wrote to memory of 3632 804 Launcher.exe 101 PID 804 wrote to memory of 3632 804 Launcher.exe 101 PID 804 wrote to memory of 2744 804 Launcher.exe 102 PID 804 wrote to memory of 2744 804 Launcher.exe 102 PID 2744 wrote to memory of 5104 2744 Launcher.exe 105 PID 2744 wrote to memory of 5104 2744 Launcher.exe 105 PID 2744 wrote to memory of 4156 2744 Launcher.exe 106 PID 2744 wrote to memory of 4156 2744 Launcher.exe 106 PID 2744 wrote to memory of 4412 2744 Launcher.exe 109 PID 2744 wrote to memory of 4412 2744 Launcher.exe 109 PID 2744 wrote to memory of 4412 2744 Launcher.exe 109 PID 2744 wrote to memory of 2252 2744 Launcher.exe 111 PID 2744 wrote to memory of 2252 2744 Launcher.exe 111 PID 2252 wrote to memory of 2616 2252 SocialClubHelper.exe 112 PID 2252 wrote to memory of 2616 2252 SocialClubHelper.exe 112 PID 2252 wrote to memory of 2584 2252 SocialClubHelper.exe 113 PID 2252 wrote to memory of 2584 2252 SocialClubHelper.exe 113 PID 2252 wrote to memory of 2568 2252 SocialClubHelper.exe 114 PID 2252 wrote to memory of 2568 2252 SocialClubHelper.exe 114 PID 2252 wrote to memory of 4552 2252 SocialClubHelper.exe 115 PID 2252 wrote to memory of 4552 2252 SocialClubHelper.exe 115 PID 2252 wrote to memory of 1312 2252 SocialClubHelper.exe 116 PID 2252 wrote to memory of 1312 2252 SocialClubHelper.exe 116 PID 2252 wrote to memory of 4288 2252 SocialClubHelper.exe 117 PID 2252 wrote to memory of 4288 2252 SocialClubHelper.exe 117 PID 2252 wrote to memory of 3432 2252 SocialClubHelper.exe 118 PID 2252 wrote to memory of 3432 2252 SocialClubHelper.exe 118 PID 2252 wrote to memory of 4360 2252 SocialClubHelper.exe 120 PID 2252 wrote to memory of 4360 2252 SocialClubHelper.exe 120 PID 2252 wrote to memory of 4836 2252 SocialClubHelper.exe 123 PID 2252 wrote to memory of 4836 2252 SocialClubHelper.exe 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\LauncherPatcher.exe"C:\Users\Admin\AppData\Local\Temp\LauncherPatcher.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\RockstarGamesLauncherInstaller.exe"C:\Users\Admin\AppData\Local\Temp\RockstarGamesLauncherInstaller.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x64.exe"C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x64.exe" /install /norestart /quiet3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\Temp\{9CBCA8B4-E0A9-4E95-B613-2E6BE172B0FE}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{9CBCA8B4-E0A9-4E95-B613-2E6BE172B0FE}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x64.exe" -burn.filehandle.attached=592 -burn.filehandle.self=612 /install /norestart /quiet4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3320
-
-
-
C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x86.exe"C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x86.exe" /install /norestart /quiet3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\Temp\{A7C9EC64-50FF-42FD-9A8D-34152B7F7708}\.cr\vc_redist.x86.exe"C:\Windows\Temp\{A7C9EC64-50FF-42FD-9A8D-34152B7F7708}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x86.exe" -burn.filehandle.attached=592 -burn.filehandle.self=612 /install /norestart /quiet4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4380
-
-
-
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" stop3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4444
-
-
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" uninstall3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3420
-
-
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" install3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4156
-
-
-
C:\Program Files\Rockstar Games\Launcher\LauncherPatcher.exe"C:\Program Files\Rockstar Games\Launcher\LauncherPatcher.exe" 3938361⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Program Files\Rockstar Games\Launcher\Launcher.exe"C:\Program Files\Rockstar Games\Launcher\Launcher.exe" 3938362⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" start3⤵
- Executes dropped EXE
PID:3692
-
-
C:\Windows\SYSTEM32\dxdiag.exedxdiag /t "C:\Users\Admin\AppData\Local\Rockstar Games\Launcher\dxdiag.txt"3⤵
- Registers COM server for autorun
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4816
-
-
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" stop3⤵
- Executes dropped EXE
PID:3632
-
-
C:\Program Files\Rockstar Games\Launcher\Launcher.exe"C:\Program Files\Rockstar Games\Launcher\Launcher.exe" 393836 -upgrade3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Program Files\Rockstar Games\Launcher\ThirdParty\Crashpad\RockstarErrorHandler.exe"C:\Program Files\Rockstar Games\Launcher\ThirdParty//Crashpad//RockstarErrorHandler.exe" --no-rate-limit "--attachment=attachment_launcher.log=C:\Users\Admin\AppData\Local\Rockstar Games\Launcher\CrashLogs\launcher.log" "--attachment=attachment_socialclub_launcher.log=C:\Users\Admin\Documents\Rockstar Games\Social Club\socialclub_launcher.log" "--database=C:\Users\Admin\AppData\Local\Rockstar Games\Launcher\CrashLogs\\" "--metrics-dir=C:\Users\Admin\AppData\Local\Rockstar Games\Launcher\CrashLogs\\" --url=https://submit.backtrace.io/bob/bcfcd610a5e9090722c12fe93ce88c188c7fb147d47b352462faca8e1e88a176/minidump --annotation=format=minidump --annotation=token=bcfcd610a5e9090722c12fe93ce88c188c7fb147d47b352462faca8e1e88a176 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff743921770,0x7ff743921788,0x7ff7439217a04⤵
- Executes dropped EXE
PID:5104
-
-
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" start4⤵
- Executes dropped EXE
PID:4156
-
-
C:\Program Files\Rockstar Games\Launcher\Redistributables\SocialClub\Social-Club-Setup.exe"C:\Program Files\Rockstar Games\Launcher\Redistributables\SocialClub\Social-Club-Setup.exe" /silent /forceinstall4⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4412
-
-
C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe"C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe" --no-proxy-server --allow-file-access-from-files --disable-spell-checking --disable-extensions --gpu-rasterization-msaa-sample-count=0 --canvas-msaa-sample-count=0 --lang=en --off-screen-rendering-enabled --rgsc-product-version=RockstarGames/2.3.0.2/1.0.87.1898/launcher/PC --rgsc-pid=2744 --rgsc-ipc-channel-name=rgsc_ipc_ab8_channel_0 --rgsc-home-dir="C:\Users\Admin\Documents\Rockstar Games\Social Club\Launcher\Renderer\\"4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe"C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent-product="Chrome/109.0.5414.120 RockstarGames/2.3.0.2/1.0.87.1898/launcher/PC" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Program Files\Rockstar Games\Social Club\debug.log" --mojo-platform-channel-handle=1328 --field-trial-handle=1620,i,9395186833438679597,17233323496704099425,131072 --disable-features=SpareRendererForSitePerProcess /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616
-
-
C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe"C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent-product="Chrome/109.0.5414.120 RockstarGames/2.3.0.2/1.0.87.1898/launcher/PC" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Rockstar Games\Social Club\debug.log" --mojo-platform-channel-handle=1776 --field-trial-handle=1620,i,9395186833438679597,17233323496704099425,131072 --disable-features=SpareRendererForSitePerProcess /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584
-
-
C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe"C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/109.0.5414.120 RockstarGames/2.3.0.2/1.0.87.1898/launcher/PC" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Rockstar Games\Social Club\debug.log" --mojo-platform-channel-handle=1792 --field-trial-handle=1620,i,9395186833438679597,17233323496704099425,131072 --disable-features=SpareRendererForSitePerProcess /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568
-
-
C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe"C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/109.0.5414.120 RockstarGames/2.3.0.2/1.0.87.1898/launcher/PC" --disable-extensions --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --rgsc-is-launcher=1 --first-renderer-process --no-sandbox --log-file="C:\Program Files\Rockstar Games\Social Club\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --gpu-rasterization-msaa-sample-count=0 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2324 --field-trial-handle=1620,i,9395186833438679597,17233323496704099425,131072 --disable-features=SpareRendererForSitePerProcess /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:4552
-
-
C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe"C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-sandbox --log-severity=disable --user-agent-product="Chrome/109.0.5414.120 RockstarGames/2.3.0.2/1.0.87.1898/launcher/PC" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Rockstar Games\Social Club\debug.log" --mojo-platform-channel-handle=2796 --field-trial-handle=1620,i,9395186833438679597,17233323496704099425,131072 --disable-features=SpareRendererForSitePerProcess /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312
-
-
C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe"C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/109.0.5414.120 RockstarGames/2.3.0.2/1.0.87.1898/launcher/PC" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Rockstar Games\Social Club\debug.log" --mojo-platform-channel-handle=2820 --field-trial-handle=1620,i,9395186833438679597,17233323496704099425,131072 --disable-features=SpareRendererForSitePerProcess /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4288
-
-
C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe"C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/109.0.5414.120 RockstarGames/2.3.0.2/1.0.87.1898/launcher/PC" --disable-extensions --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --rgsc-is-launcher=1 --no-sandbox --log-file="C:\Program Files\Rockstar Games\Social Club\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --gpu-rasterization-msaa-sample-count=0 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2936 --field-trial-handle=1620,i,9395186833438679597,17233323496704099425,131072 --disable-features=SpareRendererForSitePerProcess /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:3432
-
-
C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe"C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/109.0.5414.120 RockstarGames/2.3.0.2/1.0.87.1898/launcher/PC" --disable-extensions --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --rgsc-is-launcher=1 --no-sandbox --log-file="C:\Program Files\Rockstar Games\Social Club\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --gpu-rasterization-msaa-sample-count=0 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3000 --field-trial-handle=1620,i,9395186833438679597,17233323496704099425,131072 --disable-features=SpareRendererForSitePerProcess /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:4360
-
-
C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe"C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --no-sandbox --log-severity=disable --user-agent-product="Chrome/109.0.5414.120 RockstarGames/2.3.0.2/1.0.87.1898/launcher/PC" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Program Files\Rockstar Games\Social Club\debug.log" --mojo-platform-channel-handle=2712 --field-trial-handle=1620,i,9395186833438679597,17233323496704099425,131072 --disable-features=SpareRendererForSitePerProcess /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4836
-
-
-
-
-
C:\Program Files\Rockstar Games\Launcher\LauncherPatcher.exe"C:\Program Files\Rockstar Games\Launcher\LauncherPatcher.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Program Files\Rockstar Games\Launcher\Launcher.exe"C:\Program Files\Rockstar Games\Launcher\Launcher.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3200
-
-
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4940
-
C:\Windows\System32\CastSrv.exeC:\Windows\System32\CastSrv.exe CCastServerControlInteractiveUser -Embedding1⤵
- Modifies registry class
PID:3272
-
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:1332
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" display.dll,ShowAdapterSettings 01⤵PID:1180
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3f81⤵PID:2692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29.7MB
MD5661b5d607bb044ba7f3e4949e3913d7f
SHA14e2e4c611d5ee57c6107b60d945ca701cc7d658d
SHA256cc09f5582042eb7f00991943b65a9160378d0b0f4c60d8d14ec4ab01d0898751
SHA512ab744c104677cb4dd9375da5cb2b88524ffe45a3b30711d6ab12643ba049003b7f7996dcc863792a6cb4716f148216e27dc68957f94b97076212313532bc2614
-
Filesize
35.0MB
MD5d14efc36aaa12420df14e42e4de04a4b
SHA18abf256c97a6b2ebdb0c8f7f24bee5fc1f7be374
SHA256c184a750bb37bfd431901fa2bc24b0b163580b136ee1e0c2423d16b40c7bd74d
SHA512c907b52fb73435675681efccd47c989db4392823450e4f731b8136d7f7f927b660f4127d7fa43e98c5eeba8bc12c6efab0f2354eb71acfa2f8794673f21a69a2
-
Filesize
792KB
MD59a99b43a70472f903995dab868214d48
SHA1a077c85ccc567758707c91875c219d1822ade550
SHA256f340ca892df4920b6043d2b0533e91d32612be826613150c0fd38cc5324d8612
SHA5126561eeef1f98825e5fd989d6d7fea683ba93c9a8a05ddad6d3fff214816f2c43e2ced8d0653f3d2cb8614bdeb9246f51280d24a8f4957daec035307a78e914bd
-
Filesize
492KB
MD55dd794b1b27d7223ef469a6a818f43d0
SHA1dfb6553f692370dba29c393c357aafd85fefcdaa
SHA256f21683de6a3ad50cf0ea62b2c85e545d684f7a10a6ab15e0ccafd4cb2634e7a8
SHA512ea577103a2cf59fc93065a4a781b40dfd4597842cbadb11930f17473346f45ef572d3f0649533e3404b327ed61be498485a78ffd3df728547fd066755752d925
-
Filesize
147.6MB
MD58380089774b7f82038ec67d1a484e086
SHA1e70e783f06851e265c680db3e7c111b9ee0dd0af
SHA256b2e5b5f02da85c8f11d395468ea849754911691e095ef71beac5f57c7928d9fb
SHA51284bfe978261018cba50f92b9317fbcd79950b427df82ca05ccbc58a67c7c6f12c4c11a42a6a53f7a58234514d3f615164b65a5db4f31216b9861085c80a2055e
-
Filesize
14.4MB
MD52129ed294f60ce32cb3d674100850bd0
SHA1be4f7ad520349d9d0683ab9dd171b3a1e4db426b
SHA2566ed7281196f390184dbca70cb5604be5759095693c232a1232699b014828c794
SHA51250aff48c02bed02bf60555d22fcb919d65f3aabe18327cfed89e012a9dad2fcf8c3d3e2ef6821b90c22bf961e8af4e8e63abe9b7d4f98e5af56fb5c88a8dab6b
-
Filesize
24.2MB
MD5077f0abdc2a3881d5c6c774af821f787
SHA1c483f66c48ba83e99c764d957729789317b09c6b
SHA256917c37d816488545b70affd77d6e486e4dd27e2ece63f6bbaaf486b178b2b888
SHA51270a888d5891efd2a48d33c22f35e9178bd113032162dc5a170e7c56f2d592e3c59a08904b9f1b54450c80f8863bda746e431b396e4c1624b91ff15dd701bd939
-
Filesize
13.7MB
MD54c3dc696187b0dd900bce5886ffd28f9
SHA113439c916faaf5e08cafce790381578685b0a552
SHA2568a8b3995620aeda29d2d99359172c7a3be17720b627a2b09cb293e8c1a76b41b
SHA5129e023dd1258b20d3dd29eb3858282d5e99f86dc980becb044a867a0aa8c5210eebb426b3f7d574c3e10b58a72436c7e360c644a64f5653f19ad28b9c96ecd183
-
Filesize
13.2MB
MD5ae427c1329c3b211a6d09f8d9506eb74
SHA1c9b5b7969e499a4fd9e580ef4187322778e1936a
SHA2565365a927487945ecb040e143ea770adbb296074ece4021b1d14213bde538c490
SHA512ec70786704ead0494fab8f7a9f46554feaca45c79b831c5963ecc20243fa0f31053b6e0ceb450f86c16e67e739c4be53ad202c2397c8541365b7252904169b41
-
Filesize
1.3MB
MD56aa71704ca1337a8e9321b16080b9551
SHA11b005f1f12c672569951928b0abce832fca4db6c
SHA256a8baea353844b88bcfdf6e541a4d4bb10a627e033b3fb13d44b85ee92e706a3e
SHA51255e21bd15e93cafa02e415e53636658d31685cc72313991587a49625e0d707bc203396b234c0efdbf13e9a0e2eaa3e72cfda636307791a76d3c765e05dfdc16c
-
Filesize
1.0MB
MD5d81dad728c17eadb402528e12cd32a50
SHA1794b2f1712c34bbdce0c9cbc5d94ca3f58680313
SHA256dc8605f7645c7d82e10ce4c393e5a2383650bf492f5bdd33ae8edc656ae1c6c6
SHA51280fc5f184453fb2dba4adeed354ad413511b8697c1f5a1a55233e15243c8b7caa7f12c5bb0772eb5dcbbdb51ec1bc16ca6bd6bcacfbfce0cc95aa33642106f9e
-
Filesize
21.2MB
MD54112f67ba88806a7a7f605653c1cf6ee
SHA18fb3e9a947e9c1f7d9f58063374991b408447f56
SHA256016bbe7bc125975094661604a82eab80d1e9d23579ab6aaea31ddee5cd8f1eb8
SHA512999e7a465ea0a14e9ae8ba31b948167a3786cc04f9677a18b4789ef529b4ac8517b6e732518bbb6dc737399da540e2bb3ba92af2a573d14740503096d26428c2
-
Filesize
18KB
MD5a1952875628359a0632be61ba4727684
SHA11e1a5ab47e4c2b3c32c81690b94954b7612bb493
SHA256a41bede183fa1c70318332d6bc54ef13817aeee6d52b3ab408f95fa532b809f1
SHA5123f86180cc085dc8c9f6d3c72f5ccc0f5a0c9048343edaf62239eb4b038799845388898408ed7e8eac5d015a9bc42ff428f74585f64f5d3467dddb1303baf4f03
-
Filesize
19KB
MD56c88d0006cf852f2d8462dfa4e9ca8d1
SHA149002b58cb0df2ee8d868dec335133cf225657df
SHA256d5960c7356e8ab97d0ad77738e18c80433da277671a6e89a943c7f7257ff3663
SHA512d081843374a43d2e9b33904d4334d49383df04ee7143a8b49600841ece844eff4e8e36b4b5966737ac931ed0350f202270e043f7003bf2748c5418d5e21c2a27
-
Filesize
22KB
MD5d53637eab49fe1fe1bd45d12f8e69c1f
SHA1c84e41fdcc4ca89a76ae683cb390a9b86500d3ca
SHA25683678f181f46fe77f8afe08bfc48aebb0b4154ad45b2efe9bfadc907313f6087
SHA51294d43da0e2035220e38e4022c429a9c049d6a355a9cb4695ad4e0e01d6583530917f3b785ea6cd2592fdd7b280b9df95946243e395a60dc58ec0c94627832aeb
-
Filesize
18KB
MD5c712515d052a385991d30b9c6afc767f
SHA19a4818897251cacb7fe1c6fe1be3e854985186ad
SHA256f7c6c7ea22edd2f8bd07aa5b33cbce862ef1dcdc2226eb130e0018e02ff91dc1
SHA512b7d1e22a169c3869aa7c7c749925a031e8bdd94c2531c6ffe9dae3b3cd9a2ee1409ca26824c4e720be859de3d4b2af637dd60308c023b4774d47afe13284dcd2
-
Filesize
20KB
MD5f0d507de92851a8c0404ac78c383c5cd
SHA178fa03c89ea12ff93fa499c38673039cc2d55d40
SHA256610332203d29ab218359e291401bf091bb1db1a6d7ed98ab9a7a9942384b8e27
SHA512a65c9129ee07864f568c651800f6366bca5313ba400814792b5cc9aa769c057f357b5055988c414e88a6cd87186b6746724a43848f96a389a13e347ef5064551
-
Filesize
19KB
MD5f9e20dd3b07766307fccf463ab26e3ca
SHA160b4cf246c5f414fc1cd12f506c41a1043d473ee
SHA256af47aebe065af2f045a19f20ec7e54a6e73c0c3e9a5108a63095a7232b75381a
SHA51213c43eee9c93c9f252087cb397ff2d6b087b1dc92a47ba5493297f080e91b7c39ee5665d6bdc1a80e7320e2b085541fc798a3469b1f249b05dee26bbbb6ab706
-
Filesize
18KB
MD5ab206f2943977256ca3a59e5961e3a4f
SHA19c1df49a8dbdc8496ac6057f886f5c17b2c39e3e
SHA256b3b6ee98aca14cf5bc9f3bc7897bc23934bf85fc4bc25b7506fe4cd9a767047a
SHA512baccc304b091a087b2300c10f6d18be414abb4c1575274c327104aabb5fdf975ba26a86e423fda6befb5d7564effac0c138eb1bad2d2e226131e4963c7aac5bd
-
Filesize
27KB
MD54dd7a61590d07500704e7e775255cb00
SHA18b35ec4676bd96c2c4508dc5f98ca471b22deed7
SHA256a25d0654deb0cea1aef189ba2174d0f13bdf52f098d3a9ec36d15e4bfb30c499
SHA5121086801260624cf395bf971c9fd671abddcd441ccc6a6eac55f277ccfbab752c82cb1709c8140de7b4b977397a31da6c9c8b693ae92264eb23960c8b1e0993bd
-
Filesize
26KB
MD54e033cfee32edf6be7847e80a5114894
SHA191eef52c557aefd0fde27e8df4e3c3b7f99862f2
SHA256dff24441df89a02dde1cd984e4d3820845bafdff105458ed10d510126117115b
SHA512e1f3d98959d68ef3d7e86ac4cb3dbdf92a34fcfd1bf0e0db45db66c65af0162ab02926dc5d98c6fc4a759a6010026ee26a9021c67c0190da941a04b783055318
-
Filesize
69KB
MD550740f0bc326f0637c4166698298d218
SHA10c33cfe40edd278a692c2e73e941184fd24286d9
SHA256adbb658dd1cbecaca7cc1322b51976f30b36ccf0a751f3bad1f29d350b192c9c
SHA512f1331ab1d52fb681f51546168e9736e2f6163e0706955e85ac9e4544d575d50e6eacd90ea3e49cb8b69da34fe0b621b04661f0b6f09f7ce8ceca50308c263d03
-
Filesize
19KB
MD5595d79870970565be93db076afbe73b5
SHA1ec96f7beeaec14d3b6c437b97b4a18a365534b9b
SHA256fc50a37acc35345c99344042d7212a4ae88aa52a894cda3dcb9f6db46d852558
SHA512152849840a584737858fc5e15f0d7802786e823a13ec5a9fc30ee032c7681deaf11c93a8cffead82dc5f73f0cd6f517f1e83b56d61d0e770cbb20e1cfff22840
-
Filesize
22KB
MD58b9b0d1c8b0e9d4b576d42c66980977a
SHA1a19acefa3f95d1b565650fdbc40ef98c793358e9
SHA256371a44ab91614a8c26d159beb872a7b43f569cb5fac8ada99ace98f264a3b503
SHA5124b1c5730a17118b7065fada3b36944fe4e0260f77676b84453ee5042f6f952a51fd99debca835066a6d5a61ba1c5e17247551340dd02d777a44bc1cae84e6b5f
-
Filesize
24KB
MD576e0a89c91a28cf7657779d998e679e5
SHA1982b5da1c1f5b9d74af6243885bcba605d54df8c
SHA2560189cbd84dea035763a7e52225e0f1a7dcec402734885413add324bffe688577
SHA512d75d8798ea3c23b3998e8c3f19d0243a0c3a3262cffd8bcee0f0f0b75f0e990c9ce6644150d458e5702a8aa51b202734f7a9161e795f8121f061139ad2ea454f
-
Filesize
24KB
MD596da689947c6e215a009b9c1eca5aec2
SHA17f389e6f2d6e5beb2a3baf622a0c0ea24bc4de60
SHA256885309eb86dccd8e234ba05e13fe0bf59ab3db388ebfbf6b4fd6162d8e287e82
SHA5128e86fa66a939ff3274c2147463899df575030a575c8f01573c554b760a53b339127d0d967c8cf1d315428e16e470fa1cc9c2150bb40e9b980d4ebf32e226ee89
-
Filesize
20KB
MD56b33b34888ccecca636971fbea5e3de0
SHA1ee815a158baacb357d9e074c0755b6f6c286b625
SHA25600ac02d39b7b16406850e02ca4a6101f45d6f7b4397cc9e069f2ce800b8500b9
SHA512f52a2141f34f93b45b90eb3bbcdb64871741f2bd5fed22eaaf35e90661e8a59eba7878524e30646206fc73920a188c070a38da9245e888c52d25e36980b35165
-
Filesize
18KB
MD554f27114eb0fda1588362bb6b5567979
SHA1eaa07829d012206ac55fb1af5cc6a35f341d22be
SHA256984306a3547be2f48483d68d0466b21dda9db4be304bedc9ffdb953c26cac5a1
SHA51218d2bdce558655f2088918241efdf9297dfe4a14a5d8d9c5be539334ae26a933b35543c9071cedada5a1bb7c2b20238e9d012e64eb5bbf24d0f6b0b726c0329d
-
Filesize
10KB
MD57b2debb1075133c1577e5888e5e1f19f
SHA1df3cdb80ec6bbef02bb517194697b947d2d665c2
SHA2562f4a612844db30334b01d78c223b816d8391ce51f79e820cbd6c8a34c5eb1e44
SHA512058e41be36424e752f54996f34009330ca8ee75820613bf89760c3f1efcaf8c969f2267923f19476d147414c89c0b579179bf4c64378915df79770d867177a4b
-
Filesize
10KB
MD52b4f554dc71834ba6c7f92a7315609ca
SHA1b79b3277b1271fa4c93fa274911b8cd0a3ef18c6
SHA25682a8a66f3fac069c2c89394d8272ab119e13fe93fae11132d8109752c818baba
SHA5123d171737762a80aeb081c40575a0e92abd29e53586ff5b40072f6ebc7f931dec6af70879e9e48bad19f5984f449e3442611d0d8f4066ee7df1c2913017a2dbe5
-
Filesize
10KB
MD53b34b8ab4220041eeaed9f8e28865fb6
SHA150263bb92a7ab1e68c453c3a0ad9f69762aa0695
SHA25638f5739453f1b3627d6e92aa33c67b1a55e1a9af2da88ee97c7bcf04f89eacaa
SHA51293048ccb04e2f050c6d23123cc0f723dcc13d38a461520f7bc0753bc03f4740188deb653476f2df77d35ea5406d68a3f19aef6db7238f4214cb8225fb4984597
-
Filesize
10KB
MD5d8c63c948ebbd70320a57e87f50fdd57
SHA140ec4765ec6b9a5705aca64c96dec4f0ebe4896d
SHA256e33daf5680b40442f0a9103ed4557c86541f0a8bb7c1c085e997af0a86706079
SHA5122930131ab6542d8163042d0d20b8a4345ef6c9f13e719846c5049d0383e0dd1b69aeb54830b6119f528b7386ed836c3fbf101421816117aeb98b7a477f3003e5
-
Filesize
16B
MD51707d6cbdff916782b28141ce2089347
SHA12374545b8b4cf4b16a27afa9fdb5b2654ca9e96a
SHA2568035f74093e5dc33ebaa9aca094481f746651cfc855db42a773350abebd98c5f
SHA512c7054ce442358b28dc649efce608dd97e2f57347aa78bbfebcaa01edb45e6eab94dc6ba0d30a6ca252491b9ed96dc2463b0a318c67a151390080b680a41f7a9d
-
Filesize
992KB
MD50e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA14189f4459c54e69c6d3155a82524bda7549a75a6
SHA2568a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd
-
Filesize
6.3MB
MD59c5d29ef18d350475719dec925502014
SHA102c2175c64aa50dc820f6aeff6859a1a36d6410a
SHA2565eb760589fe2f20ebed1acd381351aa1bc083407759b0dae0bc44d407586c746
SHA51290dea47dec864f6c8b35b28d451e555a88b41f95f15d3af738a22420bade7de9042a7e547bd2a012fccb1e05d96eee9fc9778d526dcf02ba328f446b55efca4f
-
Filesize
1KB
MD597fc4fdbd58f2101799a051cfba8826e
SHA12c3706305bfaf79d64110283a86eb8b6987e4eb2
SHA2565029ac8214564b00687a2c94b57e5810e12927bf0dc338d08e9d80ac29279cca
SHA5124c9a09df7ba413ec006ef36552765cdffd57f89f28e679c2c7ab91d893365a9c4a2c91b29eaf0f9fe6fe4cfc2d77c206ce7936bfb9e2f8de856e3a56e11b0a15
-
Filesize
2KB
MD5778c73ee8e6c7eacfb248fdabd4dda0f
SHA11e714487cc56cce128877dbd0577c1bee3d1d2bb
SHA256b4dd3e1d0a83c86594811eb3462f2a259451179ac66abdf06be43cf060934d11
SHA5126b34b2ed19ae50970e08c3d92b2f40af60da5fbeba59f45bec362a96da63ea93990bba725ba203aa94e8840e81f7690bd58d16c86f49e327290b75db90bde021
-
Filesize
59KB
MD5d31654a8819f0002305af7553274c3df
SHA173570fe6ac9474b086447546cc18097803010887
SHA256535326bdad2d71b27b596c007b30e31536255f8338823917afd9484887176316
SHA5120fbbd414bc82654dc47286a9f3e6f760f8928ab17a60c435cdf0c0e5a9d01214bc3e7d573e64b32310b9ad1837a31b96045250c32d60cc9617bd2e5adf712abf
-
Filesize
85B
MD574aee299e962241cdcbf8fd36bada727
SHA1775887f6bcac77d23b31c5f0059bee2dbecca2bb
SHA25684e161ca26921cebf63f4b1be89ba0becaef7cf22692427f897c9e1fd4e1a0d4
SHA512d10b9569ac0fb8de194d0755276e41192f2da54e50d99d41f9ec23706a11334e40317031376e616418889e342512f3f0f453273a83f5d0956d0f7bb818cc4525
-
Filesize
787B
MD56d07e152c8f1d54f3ad88f100812253c
SHA15bfe9a4cee93a1f4a1e649e1949e813c0f561186
SHA2563a9b30ad48e971e638ae50a05fe8113a0584d2a9bcbc9b9eaf599f15328ddaab
SHA512bffa87014e3c5fc140ec1c006f6d1b827568c712c3946c7611a388b273656edd4a4649ce5ede15f410b34a77489c6384a0875597eb10cff5c3b5479a86f22187
-
Filesize
1KB
MD58d013d45a45f5314066d89c6daa0deb1
SHA1ad1d866ddce8d6411082c4e56d25c43c2c327d1f
SHA256897d857429d1be23540bbd2a83038129ad354cfc5dc36dbdc04a0a279a780430
SHA51233168b6aadd700a17d08f81cff154f55ae0a278614aac4b7b6a5f066f4ee14dcee734010630d662eb8187acfbd871d08b6d3f0a9d537e115a14731e542838a3d
-
Filesize
71.2MB
MD583b68a2dccec731195b82de1a302c530
SHA12a9a3f9368b790e125494689e113efba6cc6dba9
SHA2562962c05ec26ff6cd82bea004c0bdc091355c33c2d3228e9ad0fe3e9c8dddcb27
SHA512f27a94410fa07b588a8f17f7bb11ef96a3fb478e03d4eceb4608e679a8c4d98d538490d1586a492d8bec4fd8e0239ad5ceb39e0f53dc804aaa4cd38263714824
-
Filesize
1KB
MD595c81a38da0c068446cbb833aab4ae53
SHA17f1a3aa8cec8b029f197c4fba714f9980f74367d
SHA256e31a9e65c5400475134d229a95e1a277996e4970f49d9e7d4b956972da59fe6e
SHA5125745f95cb5ad1b04120d341d92197e39c2932b114c3ccd8da115400bfa97b1d9e22864cb903b091fd6e09d6a2ec3bb6aad09a29669103221bf75798aae778911
-
Filesize
39KB
MD57136e4dbb5139ec5c4928cef6e3b256e
SHA16cecd546b7e21a9f014b60bef45461608ff80a35
SHA2565f2e0dff09b6b2288dd563e3cbc76f3ef16365c49b2fcdcb18d838e24b6c33f8
SHA5122ef596f0a70cfa6265b145c4f80035d42a86497dec575c194e4c3c9caba2e76e6cc2ca3d3790485329ed41136e1f75d18a99ab1608b30a70d5b5f1ad143cdd71
-
Filesize
7KB
MD5c7702e1129e6d4b85fc727073156eda1
SHA10e6e54b1bf89c183ce4e81bffd2767e0f02b6f00
SHA2563c04dfccc12e7ec01b2e74ec86ccf77c033a5dcba09d87ee0bd5949a6fcf97a2
SHA512e414dee51768d894206301d084562696ec5fe276527030d8094fcf4aaf3232b76a26ed53be5e40cb3a1aefaecc13a544792113cdd33f88e049632c6709d94eab
-
Filesize
39KB
MD55c74bb523eaeca73fcb2dc81d37402c2
SHA1630e660117d516066d27ac906f6e6e5921571d08
SHA2562b674f78e9cd6d6cf086d9ca85ce5dfed98a575a40e6497e0ded4b78a57cf6a8
SHA512ef6943be74b98176e7b91c25253a70e2163e7c8cfacc1411c1e9531122b0b51f0013948ee89618add157a197d6f6e2a219022969b2243e330091354ec48a01d4
-
Filesize
39KB
MD57ebd0318d7d3d7a3532151bcff1d04c6
SHA13816511fd6857232263cb7d7af3cf6234e9f70ff
SHA25672a73631e59983c84c6ce24e86a6efd7767f54448e39c2c5eeb464bc65b2558b
SHA512118e97e637d3e2a31b3a90d423624da3228e6c806b8f5d2bda9e86e1b2cd131c3016bc1708ae92859e673592230e7a17e4a32ffa214f0dcb307338a48ac46069
-
Filesize
39KB
MD5acb46e2e37eaa1cbc3bb4a7cdb546045
SHA1b15a443ad00ace9d1db5837ab0dcd86506ce72cd
SHA256b90d030707182488915b1997963aad894b1b7339862d3daac04ba215829cbc3d
SHA51243c8382b46862cda7a24213bb6d615ed8e41715b912bcb8c6ab4d90bdf2a8ae93423dc76cb6de1ff08d4d942ee9251451e9bb5e48d57145df6b621ca3d9a940f
-
Filesize
534B
MD5fa1f227f50d41c8301989df2be7024f5
SHA1213dbbba965e7c569148d5d48675fe82c74dd3c0
SHA2568e48ea1afd287332bc2841571af8257a9b75845b8494c5c7acc9d2184c98666a
SHA512e3fff2f283337c0ece17bfdfcd149bc0d0f234061890f610f0f125096fae6be71464ec8a4e7cd0c858f7d7db58fd8850cb161200eb0ea86ad59f42eebbbb4017
-
Filesize
58B
MD5490627bad50a1f914b44ccbd20ed38ed
SHA1552d166d214675e8e6f2b595ab5026ccdb8e3e5f
SHA2564435aada592156075931aec17b3b2494047664687afea22cdb7c98453e44ae7b
SHA5123c91f117a3df0c0eb1ae953063578dedc1451c287883f87c43f1f5959bc677e71151620ac900a64e14b7d881ff4423da2a930fb8d8422fae76ccb2538c725ced
-
Filesize
11KB
MD555dea53bc3c601c0a6075130ca107553
SHA1fc60278469a742bd21ccef184885e44a9f7d7e35
SHA256e14eb9e1f53eb2c122c68d0ba9f68dd49efe703ad8af39ef5dcc3fa32f960d16
SHA512413e8961cfff76988ffc0ab57a46e1226135227ced4a312b6a48329eeacb0d05ed78d77292c005df852f2373564020ff645a9d62903c722fd9dd045fec6718bb
-
Filesize
47KB
MD597152f7290f922102eda60a4bc1866c7
SHA1f1807ec180008137ac39eb9262eed1d4be6b147b
SHA25622b5a3885c3e3470a163f5bb905fd157423c797355d39a1f2b01e2f9486ea85e
SHA5120ef438247f8619a94c1f66b063598ac228f75cc5037e526a36d089e145ad5506d39731d945226ec45f5054abe3924242648b25a7e01312e8f246b3783797734b
-
Filesize
343B
MD5a77eaf2c797aba7dfcf62f20ae5a82c6
SHA14404925f13e36bb3bc54cca29b68ad2359b99fb1
SHA2563e93bb26bf9013cbe38ae1eb8ec58cd5e8fe8c46435b79590a0f3b3485d151c2
SHA51218f4aeb438a9d0c7e1a4f9fd0dee2158d8ffabdcc839af77fd237d24acdda79db127547a88bbe3ad7ee8d406d8dc39b33c1d17dff11144e1d97370a968e971e3
-
Filesize
198KB
MD5319e0c36436ee0bf24476acbcc83565c
SHA1fb2658d5791fe5b37424119557ab8cee30acdc54
SHA256f6562ea52e056b979d6f52932ae57b7afb04486b10b0ebde22c5b51f502c69d1
SHA512ad902b9a010cf99bdedba405cad0387890a9ff90a9c91f6a3220cdceec1b08ecb97a326aef01b28d8d0aacb5f2a16f02f673e196bdb69fc68b3f636139059902
-
C:\Users\Admin\Documents\Rockstar Games\Social Club\Launcher\Renderer\Code Cache\js\index-dir\the-real-index
Filesize48B
MD5d4a43d192666ed6f21fe2b4b24c01bd0
SHA1ad9921cf1402619821edff5c6a058bc7cdb5704d
SHA256db0e81ebcf7a16cab0fe8bc203655dbfbb4ee0ba90d94723f669f5c052d867b0
SHA5126f36f5f17648ab2c1d5d69be8ab9e670d25494bba605d9d07ffca8c996e34009bc0186d8a16491af06124976dcbafa439aa2abfb65480dffba2918eb8ffd71ed
-
C:\Users\Admin\Documents\Rockstar Games\Social Club\Launcher\Renderer\Code Cache\js\index-dir\the-real-index
Filesize288B
MD5b9d5a5d88eca9d5c474081dd3e6cbc9f
SHA1a9df88009d15fbfcd9422d336ec1f6080ebc7384
SHA2560d67c485ebdcd73468ec59124fa98b88d0e5e26a0f7189a38bccec15b26cb4cb
SHA5129d33d19470c0bc380c72f3e91440ca94f88262f9442691b808b797683cfb8c0ce2797d3ccc768deba5ea546125f607151f346b63db74edb69ddc40401f191c49
-
Filesize
693B
MD5752f918a251c9349e21167dc107f46be
SHA1822289fc85f3a05f112205065fcffd94fcc3095e
SHA256d4c52160b39d581a8c638abd07528acd47e753cb6e6bc242d1e470ae5860185e
SHA51249cb3cb5401bae7947bf9f4be6394302af6b7403fa41a9e3590d97180e77a5f0dfac171547bb0a3be23fc101955f48e87cb77fe9fc63b7e19a06284b3a34963b
-
Filesize
484B
MD50792005db4b06a8763d83a4d6e3462a7
SHA12544596ffa7ea48378c168952085ec593f22a941
SHA256abc98c6b3e0b79b179a9ad9a65dc50be08169ea3fa5066b1495bb8c89b02066f
SHA51252d94a8f8eefd17ae566f3d261ad0a354ffb0a3bfabcf5224e9cded2685f426d78b851450613ceefd90269421e7b4c804f95d2f7d2c3d82662fe94b5854469d3
-
C:\Users\Admin\Documents\Rockstar Games\Social Club\Launcher\Renderer\Network\Network Persistent State
Filesize2KB
MD5824cd12957566542dcfe9266dad2ccf1
SHA1d3dde416679ea3ff598d6dc9645f824ea20f74ea
SHA25699189e3475f2e9f3a2708a1219cb8b6b07b110fac643a9a55f3d1ae73a9c9186
SHA512fb19f3c22243f5037f2291357066d2d3c66a8c8bd3224c50a3129eee08c9a2bd98d5220d14cc75a598d554fd1fb4479a27261b14cfbcf1b6e708daaf1d0b9bc9
-
C:\Users\Admin\Documents\Rockstar Games\Social Club\Launcher\Renderer\Network\Network Persistent State
Filesize2KB
MD5a7694a8eabc4fce69a26dcc691188663
SHA1e86a514cff7d371ab2ff3d90d08b1dc16f748bb5
SHA256625c795ccac1abbef664d32272952ae9acd0795bfc9ed6aed6769ce334cc9fce
SHA51224eada1bbd9d3ed8e83294c4c296c1c0aada236978338bbd3cca32d6dac8bec324b0c808ba050d71bfc21959c1b02e034fa5c41e45dc2393110c53e5151a59bd
-
C:\Users\Admin\Documents\Rockstar Games\Social Club\Launcher\Renderer\Network\Network Persistent State~RFe5b75a9.TMP
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
Filesize
1KB
MD5dd4a8eeee3e0bec08efd6e94fa8c3c94
SHA1356cd4c8e620f36a4981b0eaa674930023f7bc4f
SHA2569e33088888a827d9c8c6defe9e35fe87be6502ba147aafa4f040a1578d6bb101
SHA512105540cc72fb92c2bd2809e1e6a92d6b25656605218c95baefeae4f120a6018ea46853a1ae53980bb2cc50086fd0ef1d79e3382a58a4b3899a9196a6df39f31f
-
C:\Users\Admin\Documents\Rockstar Games\Social Club\Launcher\Renderer\Network\TransportSecurity~RFe6ce122.TMP
Filesize1KB
MD58fda974220af27ae9da93c182039a76d
SHA154d16acfe4c6f2e9ffdc7edaeb68e89d8218bd10
SHA256ff7668d809a035699ab3d802fdca4b7caa79b2ae3cf83ebdb03385bec5ec691c
SHA5125cba06036eeb581e7168bbd317a05a6595f4bf6bfcbc611fb201dd5236ac7d5e5270026c0176f7f1354308db7a97c40e0e118948c6bf07dfa16301eb7b61caa3
-
C:\Users\Admin\Documents\Rockstar Games\Social Club\Launcher\Renderer\Service Worker\CacheStorage\7c129e28a53a20755871f994f1997209760a9724\2058be64-fbeb-4f8f-9ae1-bc4e8e107ebe\index-dir\the-real-index
Filesize96B
MD5767afef272a9c9c69e523966dd336adc
SHA180306e92546fae4ee13a94ac15f2b930e1056ee6
SHA256ddd33ab84620bb754fdadb7833e5c26eda0b2519b9e6145a540c756d182fe59d
SHA51283b52dc55907c4f0cf0c3563fa93e7de64a3af5eef98f82b2aca4ec43499cc0d60dadc5d68f9687901d4731d9580eb1dbe5cb54ca80bba9ce392fefd9f34b2b6
-
C:\Users\Admin\Documents\Rockstar Games\Social Club\Launcher\Renderer\Service Worker\CacheStorage\7c129e28a53a20755871f994f1997209760a9724\2058be64-fbeb-4f8f-9ae1-bc4e8e107ebe\index-dir\the-real-index~RFe5abd56.TMP
Filesize48B
MD54b5c83e412b51c964f73b32128a319dc
SHA19b0774cd2dfc5c2cb4b4d6f85927ff4638e20b3d
SHA256aa08f73ea29e1d988482f9fcd3cd25eef7568814cfddad59d4194b68213c94b1
SHA512dd03b7db72834659a96b9f162083880908020d648984b49721dbe5ad98768ae213aa3699b996ab9f1b9394e4f8fbedb2a45ce97f7b2de32e5e1313a9ea660480
-
C:\Users\Admin\Documents\Rockstar Games\Social Club\Launcher\Renderer\Service Worker\CacheStorage\7c129e28a53a20755871f994f1997209760a9724\index.txt
Filesize137B
MD538ca0a3599048a6542743c90b7cc84bd
SHA1ef3f8110e9601c41f312e0cca327647ffbbc7ace
SHA256068cc9765b7ad1acdba9f994c072f9e1f11e7ae9ce7c010b832df57821da98a9
SHA512c3b5a89a387713a5129f5d112886c2b19daaf0d52559a8fc194e47c1cd26520a53e798ed24f339e9529d7b53d298dc89cd7123ad9d474179b1894d0ce5c2c4a5
-
C:\Users\Admin\Documents\Rockstar Games\Social Club\Launcher\Renderer\Service Worker\CacheStorage\7c129e28a53a20755871f994f1997209760a9724\index.txt~RFe5abd85.TMP
Filesize139B
MD5f90461547b072102943448daefc0d3b4
SHA194bd054c356daffbd1540b59d1c185909f4c1ac8
SHA25677e329d559203dd51dfcc7071270d63e04b9de8947fb9321a9ee299ee6bde0c3
SHA5123ac993ef49fa82359b7ca08c26df5d34dcd6eda4f719a8e386c5de46b7a9a8d8f5e7291d84e3830b56ab25d65086d6e6f4a427b86e930007233040c6b5ced3e9
-
C:\Users\Admin\Documents\Rockstar Games\Social Club\Launcher\Renderer\Service Worker\Database\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\Documents\Rockstar Games\Social Club\Launcher\Renderer\Service Worker\ScriptCache\index-dir\the-real-index
Filesize96B
MD5e923f164733dac2f12b95b0572f6b579
SHA1bd56f9909c624b55ba800acefc4440adf56ad6d0
SHA25662d80c33e7582eb2fbfcebc332fee95aa3fa8a4dec8918c0440b3473a1ec0570
SHA512027d0957e437624a75fc8974b62d659bc2cf3e4c1d6e993352f7a7e3a29396d0fc08a52b02f92cfc406949aca7dc6229eca2d528eead2bf83b4da557d1c2518f
-
C:\Users\Admin\Documents\Rockstar Games\Social Club\Launcher\Renderer\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ab8c2.TMP
Filesize48B
MD51f30cf46c6c25bd441e6f035646a5206
SHA1a132c1de0ec0ab14edddbd8c768cf1e9e6acfe15
SHA2564ab8d9c26fe0243eabdd9eac62ee00767880022a9d014055bcce4603786b9b92
SHA512103f9ce4529cf8478ce0d00f564fcc4e683e04e4fea6055d81699737eb846a1328e3c58e6bed977791799c52a7b21b70ba3347edb2e5b303908584d33a4c4594
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
639KB
MD512c2af940d0f86aab632ab8a8c43ab4b
SHA1fdc96225c1099b41197ab7cd33d3fd1b021108ed
SHA2561e93ffefd54c534933b5861f76953d00a5e6c6d4fb5f2af48dce5f4f88a06823
SHA5129752096bffd1133833ae3694b112f435632e1d1bc4f4d31d714cf3958b1e836417ea8c3ca8133d62446c5ed2d51797116858c059e6d0d29e971fe1a201e66459
-
Filesize
639KB
MD50a5355d19ed35f63339074fd1c1ed7fd
SHA13ad662cb4052d25d0f4340ba38d2d99e06f02057
SHA256c87af2956bbc97d5ef1968cf7a56f91f69039823a408476db3a42b6d4b0fc206
SHA512988f5e4864b774a62ce8726d865d9d7ec9b3829a42c575508baadc8e0f7232f806f18a025b71353122450f9557b25ae20ddbaa65f88a36d35833efd32e32a535
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
15KB
MD5f894e7068ee5f5b4489d7acdde7112c9
SHA179ec857791ad4ac76673b05e6fc44e55315424ef
SHA2563948484bc6a6e8652c2220be411cdcabab73eab46578faca8c0bd01d3ea290ab
SHA512e85b2bdc27b9721425bb03393e8aad897647053c77d7862ea541e03dc896173af6eaaf182514d46464d560d15c6b9d4652690885426ac1c68e2b9dd8d632e816
-
Filesize
4KB
MD5018d8560f2b7b366ce0982f02f8fa91f
SHA1a0b754172f4c97af0421fce68925e9a34c6dc3df
SHA2569a91a821ffb369bdd2c7cb0d630d5f1fda8882f76fc9a4e7588315c33ccc9b1f
SHA512d0d2bda15e9a0cda1f8f85d6e510724d3661ffcae3767035f6f05632158a54e82661707a6e8b2d3069e158300e74793538417733d42166abec81a7c7b465caa5
-
Filesize
28KB
MD52ee096682cc84f5fd44fb5291c00596c
SHA18dccebf054abe13e5b324dfdfbe6605553971396
SHA256671570118024c9132f12999e198cebc87b3bf1846695553bf478c5a42efec226
SHA5121ffdc3a5256b8eb62aff82c6429dcdf582009a908d43ab30d3fad84770b012be59c972323b6ae2b8d7ea2ae29d8ab3a99913205a0b33582e95dc813c31507d3d
-
Filesize
67KB
MD59d6394107e64698376114b0f51a86489
SHA10321c9408d5a3f95520860732cd3906a506daabe
SHA256b818f87c127d6319aafd6b0826c809bcc4e0e1fdcc41c9aa0d1cc003246c6b48
SHA512b6f6a99a9dcb78c1410d1b351a5df2e4eb4d43499f8d12639e5acc516c5416d268ca0fa64b0d191b6918ed12b461c68a8b58bc0a85237f3914d75f0198719b52
-
Filesize
2KB
MD55170d823e47f4be06ef750e5ec276e50
SHA15ae273af78b0c4033e4519d3fbc4e8136ec6f6b7
SHA256aa2fe03f92f63a73baaf6d52449f043859e4baad1fc0908caabee2c5c21d88bd
SHA512acea66e49acf48a74a3502bec0f62eb453df796f54aa5a6ed460735e219d757f12786825694033bb1d7c7dec6c72bf43d517dbaf7d396ad3b3943cb18b32ae27
-
Filesize
43KB
MD5552cba3c6c9987e01be178e1ee22d36b
SHA14c0ab0127453b0b53aeb27e407859bccb229ea1b
SHA2561f17e4d5ffe7b2c9a396ee9932ac5198f0c050241e5f9ccd3a56e576613d8a29
SHA5129bcf47b62ca8ffa578751008cae523d279cdb1699fd916754491899c31ace99f18007ed0e2cbe9902abf132d516259b5fb283379d2fead37c76b19e2e835e95a
-
Filesize
11KB
MD575ed96254fbf894e42058062b4b4f0d1
SHA1996503f1383b49021eb3427bc28d13b5bbd11977
SHA256a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
SHA51258174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
-
Filesize
9KB
MD5ca95c9da8cef7062813b989ab9486201
SHA1c555af25df3de51aa18d487d47408d5245dba2d1
SHA256feb6364375d0ab081e9cdf11271c40cb966af295c600903383b0730f0821c0be
SHA512a30d94910204d1419c803dc12d90a9d22f63117e4709b1a131d8c4d5ead7e4121150e2c8b004a546b33c40c294df0a74567013001f55f37147d86bb847d7bbc9
-
Filesize
5KB
MD5e81c4534fc882032078b39a01eece599
SHA14afd2f33f97ddd825ae0d7e22ad10e15854c093e
SHA256add71c2a8ea08ca5a9ef7eb9e725443ae64939f7db0ad80e8adfb89267feb72b
SHA51273874d23ff9c2eb573e961e730f17ba804734d79059d0b42c141be11c4cb923b9e377c4b17717e3acbfa00d0f3ba85d5addf933b54747b4b08434de956dc1f60
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2