4b4568e7a21b15eeea8e2c1c11cd51019ab1db961c39cb20a6a8b0313000b696

Analysis

max time kernel
93s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 21:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4b4568e7a21b15eeea8e2c1c11cd51019ab1db961c39cb20a6a8b0313000b696.exe
Size

2.2MB
MD5

f703eabbc8f894cd99538bbaa9d85d7a
SHA1

379575ad23832aadb1ef89708809567f5ef0d414
SHA256

4b4568e7a21b15eeea8e2c1c11cd51019ab1db961c39cb20a6a8b0313000b696
SHA512

9deb8f627dfde6abf16f8969a4376a6372c829206aa35b074a5db09e1d52851c2fdab394bab2c09326696d387b448a2bba475e1ca0e72b660516a4edbc34392f
SSDEEP

49152:kBto5T8wV7oI+qco4xDL/U8ElLrpqlnAn4z+c4SG+4mOPDICVtYE9p+r:kBu5TT7oIgo4xlRDttyc

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	4b4568e7a21b15eeea8e2c1c11cd51019ab1db961c39cb20a6a8b0313000b696.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	SparkWebHelper.exe

Executes dropped EXE 10 IoCs

pid	Process
3860	GameforgeLoginSetup.exe
1912	GameforgeLoginSetup.tmp
4912	vcredist_x86.exe
3232	vcredist_x86.exe
2012	gfservice.exe
3516	gfclient.exe
2728	gfservice.exe
4256	SparkWebHelper.exe
3024	SparkWebHelper.exe
872	SparkWebHelper.exe

Loads dropped DLL 64 IoCs

pid	Process
3232	vcredist_x86.exe
2012	gfservice.exe
2012	gfservice.exe
2012	gfservice.exe
2012	gfservice.exe
2012	gfservice.exe
2012	gfservice.exe
2012	gfservice.exe
2012	gfservice.exe
2012	gfservice.exe
2012	gfservice.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
2728	gfservice.exe
2728	gfservice.exe
2728	gfservice.exe
2728	gfservice.exe
2728	gfservice.exe
2728	gfservice.exe
2728	gfservice.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
3516	gfclient.exe
4256	SparkWebHelper.exe
4256	SparkWebHelper.exe
4256	SparkWebHelper.exe
4256	SparkWebHelper.exe
4256	SparkWebHelper.exe
4256	SparkWebHelper.exe
4256	SparkWebHelper.exe
4256	SparkWebHelper.exe
3024	SparkWebHelper.exe
3024	SparkWebHelper.exe
3024	SparkWebHelper.exe
3024	SparkWebHelper.exe
872	SparkWebHelper.exe
872	SparkWebHelper.exe
872	SparkWebHelper.exe
872	SparkWebHelper.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	gfservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	gfservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_B5DA75AC5C130C8FE4039EA84C08E708	gfservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_B5DA75AC5C130C8FE4039EA84C08E708	gfservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	gfservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	gfservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	gfservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	gfservice.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-math-l1-1-0.dll	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\psapi.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\dll\libeay32.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\dll\urlmon.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\symbols\dll\ntasn1.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\imageformats\qjpeg.dll	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\dll\version.pdb	gfclient.exe
File created	C:\Program Files (x86)\GameforgeClient\resources\locales\is-SKD8C.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\translations\is-BJARO.tmp	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\dll\credui.pdb	gfclient.exe
File created	C:\Program Files (x86)\GameforgeClient\MSVC-CRT\is-Q57FD.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\api-ms-win-core-handle-l1-1-0.dll	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\dll\crypt32.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\Qt5WebChannel.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\symbols\DLL\wsspicli.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-synch-l1-1-0.dll	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\is-VGE0Q.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\imageformats\is-Q5BBV.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\resources\locales\is-GOC4E.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\vccorlib140.dll	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\dhcpcsvc6.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\dll\Qt5Widgets.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\SparkWebHelper.exe	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\qtservice.dll	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\styles\qwindowsvistastyle.dll	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\gameforge_client_api64.dll	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\is-8A2QF.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\api-ms-win-crt-locale-l1-1-0.dll	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\symbols\dll\oleaut32.pdb	gfclient.exe
File created	C:\Program Files (x86)\GameforgeClient\MSVC-CRT\is-BDHPK.tmp	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\dll\libcef.dll.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\dll\secur32.pdb	gfclient.exe
File created	C:\Program Files (x86)\GameforgeClient\resources\licenses\is-UTUEP.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\resources\locales\is-O1TQ6.tmp	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\rasadhlp.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-processthreads-l1-1-0.dll	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\resources\is-T7QQN.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\translations\is-2DO94.tmp	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\dll\bcryptprimitives.pdb	gfclient.exe
File created	C:\Program Files (x86)\GameforgeClient\is-G7TCQ.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\is-A3C07.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\is-IKSSL.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\MSVC-CRT\is-M3BHJ.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\MSVC-CRT\is-CHU5P.tmp	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\dbgcore.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\d3dcompiler_43.dll	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\MSVC-CRT\is-IKCH2.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\resources\locales\is-SOS4P.tmp	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\symbols\dll\wintrust.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\dll\winhttp.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\dll\Qt5Qml.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\shcore.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\symbols\dll\CLBCatQ.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\Qt5Gui.dll	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\resources\locales\is-L0EN3.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\resources\locales\is-08UUH.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\translations\is-AUCQH.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\translations\is-ODM5S.tmp	GameforgeLoginSetup.tmp
File opened for modification	C:\Program Files (x86)\GameforgeClient\wgdi32.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\symbols\dll\d3d9.pdb	gfclient.exe
File opened for modification	C:\Program Files (x86)\GameforgeClient\symbols\dll\cryptsp.pdb	gfclient.exe
File created	C:\Program Files (x86)\GameforgeClient\is-G1E4I.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\MSVC-CRT\is-40Q8N.tmp	GameforgeLoginSetup.tmp
File created	C:\Program Files (x86)\GameforgeClient\resources\licenses\is-M8ETH.tmp	GameforgeLoginSetup.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 44 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Gameforge4d\GameforgeClient	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Gameforge4d	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	gfservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	gfservice.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gfclient\ = "URL:Gameforge Client Protocol"	GameforgeLoginSetup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gfclient\URL Protocol	GameforgeLoginSetup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gfclient\shell\open	GameforgeLoginSetup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gfclient\shell\open\command	GameforgeLoginSetup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gfclient\DefaultIcon	GameforgeLoginSetup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gfclient\DefaultIcon\ = "\"C:\\Program Files (x86)\\GameforgeClient\\gfclient.exe\",0"	GameforgeLoginSetup.tmp
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings	4b4568e7a21b15eeea8e2c1c11cd51019ab1db961c39cb20a6a8b0313000b696.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gfclient	GameforgeLoginSetup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gfclient\shell\open\command\ = "\"C:\\Program Files (x86)\\GameforgeClient\\gfclient.exe\" \"%1\""	GameforgeLoginSetup.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1162180587-977231257-2194346871-1000\{37BA6763-083A-47D2-8D96-4F0C7573E454}	SparkWebHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gfclient\shell	GameforgeLoginSetup.tmp

Modifies system certificate store 2 TTPs 12 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	gfservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	gfservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	gfclient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	gfclient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	gfclient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	gfclient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	gfclient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	gfclient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	gfservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	gfclient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	gfclient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	gfclient.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3516	gfclient.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1912	GameforgeLoginSetup.tmp
1912	GameforgeLoginSetup.tmp
3516	gfclient.exe
3516	gfclient.exe
2728	gfservice.exe
2728	gfservice.exe
2728	gfservice.exe
2728	gfservice.exe
4256	SparkWebHelper.exe
4256	SparkWebHelper.exe
3024	SparkWebHelper.exe
3024	SparkWebHelper.exe
872	SparkWebHelper.exe
872	SparkWebHelper.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	2728	gfservice.exe
Token: SeRestorePrivilege	2728	gfservice.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1912	GameforgeLoginSetup.tmp
3516	gfclient.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3516	gfclient.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3516	gfclient.exe
3516	gfclient.exe
2728	gfservice.exe
3516	gfclient.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 3860	5000	4b4568e7a21b15eeea8e2c1c11cd51019ab1db961c39cb20a6a8b0313000b696.exe	91
PID 5000 wrote to memory of 3860	5000	4b4568e7a21b15eeea8e2c1c11cd51019ab1db961c39cb20a6a8b0313000b696.exe	91
PID 5000 wrote to memory of 3860	5000	4b4568e7a21b15eeea8e2c1c11cd51019ab1db961c39cb20a6a8b0313000b696.exe	91
PID 3860 wrote to memory of 1912	3860	GameforgeLoginSetup.exe	92
PID 3860 wrote to memory of 1912	3860	GameforgeLoginSetup.exe	92
PID 3860 wrote to memory of 1912	3860	GameforgeLoginSetup.exe	92
PID 1912 wrote to memory of 4912	1912	GameforgeLoginSetup.tmp	93
PID 1912 wrote to memory of 4912	1912	GameforgeLoginSetup.tmp	93
PID 1912 wrote to memory of 4912	1912	GameforgeLoginSetup.tmp	93
PID 4912 wrote to memory of 3232	4912	vcredist_x86.exe	95
PID 4912 wrote to memory of 3232	4912	vcredist_x86.exe	95
PID 4912 wrote to memory of 3232	4912	vcredist_x86.exe	95
PID 1912 wrote to memory of 2012	1912	GameforgeLoginSetup.tmp	96
PID 1912 wrote to memory of 2012	1912	GameforgeLoginSetup.tmp	96
PID 1912 wrote to memory of 2012	1912	GameforgeLoginSetup.tmp	96
PID 5000 wrote to memory of 3516	5000	4b4568e7a21b15eeea8e2c1c11cd51019ab1db961c39cb20a6a8b0313000b696.exe	98
PID 5000 wrote to memory of 3516	5000	4b4568e7a21b15eeea8e2c1c11cd51019ab1db961c39cb20a6a8b0313000b696.exe	98
PID 5000 wrote to memory of 3516	5000	4b4568e7a21b15eeea8e2c1c11cd51019ab1db961c39cb20a6a8b0313000b696.exe	98
PID 3516 wrote to memory of 4256	3516	gfclient.exe	100
PID 3516 wrote to memory of 4256	3516	gfclient.exe	100
PID 3516 wrote to memory of 4256	3516	gfclient.exe	100
PID 3516 wrote to memory of 3024	3516	gfclient.exe	101
PID 3516 wrote to memory of 3024	3516	gfclient.exe	101
PID 3516 wrote to memory of 3024	3516	gfclient.exe	101
PID 3516 wrote to memory of 872	3516	gfclient.exe	103
PID 3516 wrote to memory of 872	3516	gfclient.exe	103
PID 3516 wrote to memory of 872	3516	gfclient.exe	103

C:\Users\Admin\AppData\Local\Temp\4b4568e7a21b15eeea8e2c1c11cd51019ab1db961c39cb20a6a8b0313000b696.exe
"C:\Users\Admin\AppData\Local\Temp\4b4568e7a21b15eeea8e2c1c11cd51019ab1db961c39cb20a6a8b0313000b696.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Users\Admin\AppData\Local\Temp\GameforgeLoginSetup.exe
  C:\Users\Admin\AppData\Local\Temp\GameforgeLoginSetup.exe /VERYSILENT /SUPPRESSMSGBOXES /startedFromGsl /host=393642 /msgId=32774
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Users\Admin\AppData\Local\Temp\is-VR4CG.tmp\GameforgeLoginSetup.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-VR4CG.tmp\GameforgeLoginSetup.tmp" /SL5="$100058,78506937,930304,C:\Users\Admin\AppData\Local\Temp\GameforgeLoginSetup.exe" /VERYSILENT /SUPPRESSMSGBOXES /startedFromGsl /host=393642 /msgId=32774
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Program Files (x86)\GameforgeClient\vcredist_x86.exe
      "C:\Program Files (x86)\GameforgeClient\vcredist_x86.exe" /install /quiet /norestart
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4912
    - - C:\Program Files (x86)\GameforgeClient\vcredist_x86.exe
        
        "C:\Program Files (x86)\GameforgeClient\vcredist_x86.exe" /install /quiet /norestart -burn.unelevated BurnPipe.{E4DF829B-58BE-4BF8-8C98-CBD18D377C4E} {785CFA6F-0B08-4B77-90B1-CB52650A51F6} 4912
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3232
  - - C:\Program Files (x86)\GameforgeClient\gfservice.exe
      "C:\Program Files (x86)\GameforgeClient\gfservice.exe" /install
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2012
- C:\Program Files (x86)\GameforgeClient\gfclient.exe
  "C:\Program Files (x86)\GameforgeClient\gfclient.exe" "gfclient://game-login/?game=fab180a3-cd65-4b7e-bd0e-2ef77fd0c258&region=de-DE"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Program Files (x86)\GameforgeClient\SparkWebHelper.exe
    "C:/Program Files (x86)/GameforgeClient/SparkWebHelper.exe" --type=gpu-process --field-trial-handle=2984,8087368550907186256,9378514109786347980,131072 --no-sandbox --locales-dir-path="C:/Program Files (x86)/GameforgeClient/resources/locales" --log-file=C:/Users/Admin/AppData/Local/Gameforge4d/GameforgeClient/browser.log --log-severity=info --resources-dir-path="C:/Program Files (x86)/GameforgeClient/resources" --lang=en-US --gpu-preferences=KAAAAAAAAACAAwCAAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=9971740599077127941 --mojo-platform-channel-handle=3024 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:4256
- - C:\Program Files (x86)\GameforgeClient\SparkWebHelper.exe
    "C:/Program Files (x86)/GameforgeClient/SparkWebHelper.exe" --type=renderer --no-sandbox --field-trial-handle=2984,8087368550907186256,9378514109786347980,131072 --service-pipe-token=7698930294352780643 --lang=en-US --locales-dir-path="C:/Program Files (x86)/GameforgeClient/resources/locales" --log-file=C:/Users/Admin/AppData/Local/Gameforge4d/GameforgeClient/browser.log --log-severity=info --resources-dir-path="C:/Program Files (x86)/GameforgeClient/resources" --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=7698930294352780643 --renderer-client-id=3 --mojo-platform-channel-handle=3672 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3024
- - C:\Program Files (x86)\GameforgeClient\SparkWebHelper.exe
    "C:/Program Files (x86)/GameforgeClient/SparkWebHelper.exe" --type=gpu-process --field-trial-handle=2984,8087368550907186256,9378514109786347980,131072 --disable-gpu-sandbox --use-gl=disabled --no-sandbox --locales-dir-path="C:/Program Files (x86)/GameforgeClient/resources/locales" --log-file=C:/Users/Admin/AppData/Local/Gameforge4d/GameforgeClient/browser.log --log-severity=info --resources-dir-path="C:/Program Files (x86)/GameforgeClient/resources" --lang=en-US --gpu-preferences=KAAAAAAAAACAAwCAAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=7446804904240635876 --mojo-platform-channel-handle=2264 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:872

C:\Program Files (x86)\GameforgeClient\gfservice.exe
"C:\Program Files (x86)\GameforgeClient\gfservice.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-datetime-l1-1-0.dll

Filesize
18KB

MD5
9f3cf9f22836c32d988d7c7e0a977e1b

SHA1
1e7bbd6175bdb04826e60de07aa496493c9b3a3b

SHA256
7d588a5a958e32875d7bd346d1371e6ebfd9d5d2ede47755942badfc9c74e207

SHA512
16c98e6aec67ffe4558c6d3f881301490be5d8a714c1adc6735005613251adb8e1c2cb9b1c0d2504a9a99c61a06b0e30c944ca603fc00fbb18cd20ba1c9bd697

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-debug-l1-1-0.dll

Filesize
18KB

MD5
64978e199a7239d2c911876447a7f05b

SHA1
0048ce6724db08c64441ce6e573676bc8ae94bf9

SHA256
92b947f1d6236f86ed7e105cff19e23c13d1968861426511b775905e1d26b47a

SHA512
9c64211895473ffc7162b56b0b8e732dec54cf03ea9b9b36fe3cc3339c35fc71fc7173d4e146989db399cb1bcb063079378bb6f778f7d2591cd545550038397c

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
18KB

MD5
9d74d89f2679c0c5ddb35a1ef30bd182

SHA1
22eaed07a6e477a4001f9467b5462cf4cc15cc16

SHA256
e207ffc6fef144e5d393e79de75f8f20d223f1ac33a011eeb822d30fa2031046

SHA512
725626e961d32398ea5aa120ac0339deeb493fc02ee7ef4d8e586173fdbf768b5cbb1f16f093ae4ecfee87e661170f8f832777640a353df5d651af4a62a2d819

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-file-l1-1-0.dll

Filesize
21KB

MD5
d826d27c73d9f2420fb39fbe0745c7f0

SHA1
6e68e239f1a58185c7dad0fcfaac9ecfd2e5726c

SHA256
c0e5d482bd93bf71a73c01d0c1ec0722ea3260eba1f4c87e797bae334b5e9870

SHA512
c49843eb10e4e54c66e0e194dbd29ceab9094bdfe745b6a858cb03e34d73a6326f54804e5e5505deacc87146cbdfba17a0f02e62e76c685bce0cd1ff41962ff4

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-file-l1-2-0.dll

Filesize
18KB

MD5
ec4f2cb68dcf7e96516eb284003be8bb

SHA1
fb9237719b5e21b9db176e41bdf125e6e7c01b11

SHA256
3816bbb7dd76d8fc6a7b83a0ed2f61b23dd5fc0843d3308ee077cb725d5c9088

SHA512
6cbda80c476a9fcf46458cac45229c96dc9df251230531e25088e834cd954db9ff4561e744f76495f9c57a4068b7635c72c6f9ff838436c54142297ee310b236

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
b9287eb7bcbfdcec2e8d4198fd266509

SHA1
1375b6ff6121ec140668881f4a0b02f0c517f6c7

SHA256
096409422ecd1894e4d6289fd2d1c7490bd83daff0c1e3d16c36c78bd477b895

SHA512
b86348d3f42d0ff465066a14c281088c73ec5e03efacdaabe27a410b054a8a81b438d7e5d030b0d95f53b07783911b8b8200581d4e0b6f1b3cc79f4aae1d67df

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-handle-l1-1-0.dll

Filesize
18KB

MD5
6a35a52d536e34ba060a19d06b1dac80

SHA1
0494a9cbf898e5babb6e697fc2de04a128d2fc35

SHA256
a369ef130749bf8cd9f67055179e6f537f200c060af47493d49473912a95021e

SHA512
a8aeb58bcf4b314212c2ab5a8fd3c2edeb97e680f774171d4a79390aa23bb62a414aef0ecd5286ffb68b7ed8f6e713ff1892d6d4cc2cbb67de916c6062e762d9

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-heap-l1-1-0.dll

Filesize
18KB

MD5
ee5c2fb7bc23bfd06ff32556cc7c3b4d

SHA1
5d60ebf016219bbec340d353a4fa541fff596d3f

SHA256
efc9f0e32bce971900ddf66a1a9e68daa3bfb2099a1ba9f24c6ee82da2cbd6e8

SHA512
5d1b8a130c27d8eb63ca0c836bdf63e76afb311de26ed4f25b073bda843ebfa25e136849e3882822257e3783058f30af818a96764d60821a40329cff4e1badac

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
18KB

MD5
48a5e206d92f3102256ec65e8d570ee0

SHA1
76024fad398dfa4734afce0cc2e5ac117f090ba6

SHA256
a272ae4fc60e511f48950b08f106fcdd3bc86831df908ee78d630f1ae921880c

SHA512
65407da566b571e050c25448be6042e84b0c1c7248422cba00b543af9de425a723b0c7c54c4eb6f534e42b1679a058562d500875ddc4f2b52e6b8e6107b1b575

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
18KB

MD5
e33f52e89dfc376eaf7aa655f260ca76

SHA1
b66e1f934f491544190714966031b6dfd2e349ec

SHA256
0bd03e89a539aaa3100e2f7d9a058964730320e55aee1f85be8fd243eea7017a

SHA512
95cb889599801ba7fa225b633d0fe25fdcc8b495dee5eba05b15a6e53a8a3643b5defe1a881236c40f4fa4365d6775ece067dbb526afdf2015f4d1355c9dfc57

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
dbb81fcc74c59490008ee59bffff5a6d

SHA1
edbb465ab3bea3a4df3f05e5a4e816edbe195c3b

SHA256
f33e6ac5d3e1c4f1d89564fb6aeeac170486c073b67694380755049dbc48eec1

SHA512
2847a73e952bd5f2448264e0bfc8dc1dcd37f8b02d6d6f525ef0cb69c8e634fdcc4637876361b22c53244659039ed305c015435834b61eea15015fed45e9c374

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-memory-l1-1-0.dll

Filesize
18KB

MD5
0ee9e0c830a7534dcfc9be72146796f9

SHA1
cecc860b494135482ae693f8e252301073a98578

SHA256
8f3f0fd765a37f48162f0bd00c3047e79b4eda355223bfcbed4d35b51349cfcc

SHA512
47161e02f4478464ab45c1e3bf9d244d34613e0e68ebe48511a9a0c4e7f8ddb0c1dfd59707c6968c5d76d5027cd19ef748d1235bf74b976410ea6672a6a4bcaf

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
18KB

MD5
1557093add722d1c5a97c359bfcd0d77

SHA1
a8ce995f00a12a81a13d3ef47ce0834178ed69a4

SHA256
3a20635a223e68418c22858413e8c603aac25723de1cb0f54dd675349ec3213d

SHA512
b7acd6882b4d36b52f1e49e4b61ddd025de8503f765b72c94ec5a0d85b6ced513c348f7c4898675728c851a2632ad71c78937cdec9dff994b7b27ed2d85cdddd

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
19KB

MD5
2a61e4e21bf255107884b6520af5bbcc

SHA1
884eb1a835bcde4e7fd98134f0be797229f4239a

SHA256
64742ee0729cbe72555247b0165fae03bea7a6b0147869253dae3bb0072173e8

SHA512
d0ca104904352586bbd3da654125b3df9355fe250938a465e8e900d135cec397f1118fdf54829b076df82b8e45fcd7656c2c7aa33ad3c0af5189f7a55e43f498

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
20KB

MD5
d5c4b8f7260563f72150a84fe884ee31

SHA1
dae1185359ed25a4974504cd1ceaacde28d4318e

SHA256
02839f3b2bdf6adfc89d2f800cc8acda59a40c3e7ce14ef3026f4c72e202297d

SHA512
09ca23413eecf1df94aa36e53fc6fff0f402f21eda2ef79be6aa087818a5bb82ed98db790a2b5cf4ef91a8f70d8e27f56313bc2054a26872d2cad611c472f0b7

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
f61b9ecb79cd20fc2e8fce87286cfe43

SHA1
7a48accbe43e156f886f1f2836f74e1043feec59

SHA256
bfa24f94ba095174b82d3657f8ecc689eab8ff380c69b1c9a7e311eb70d66386

SHA512
42ab62087bbc9fc9c9003ae96ebb9e9bbfa3db4eb74bd6746da035d53d1002015d8482ecb92620ec65c42b8b2b41d9b0a7793e105b0cf8cb6f713a2bc03241db

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-profile-l1-1-0.dll

Filesize
17KB

MD5
a472bd416bdc12668523670360650910

SHA1
831d930ef9917e0dccacd8e7f7fd6f3d90082441

SHA256
48dceeea29558966c391cda34e5755386c2e7e252ea0a03d8d1f21e3cb370c5b

SHA512
166134e6c3403f4437e10afb514a55677481d3b03f7cfdf17917a0bb6fa1f387feae58d7dd5dfbc375eae66d24f10c3163ba5958c22beb6978c0b778c2883b6f

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
17KB

MD5
525a156e0ff61306fd44bf7937cacfae

SHA1
6a9a88317a55c939c0cb9f77256f5c3f961d0562

SHA256
41c69b545d931045a280f83b2f5fbe0ea18c35ac42dfca54b661b42fe8e4f982

SHA512
c99147eba45e9561b7a2802b0c15a2df2ac886ce95a95f2980f8bf4d1dff92a69b94f11cd17383b577303f24295b1b7e52b8c80ad26c0bb08862c726b9cd8841

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-string-l1-1-0.dll

Filesize
18KB

MD5
e57ec98e69961e45cc7a4e0666d26b7d

SHA1
70462a1d68bf49908fcb7186743a47a1affc5d7d

SHA256
52c9b061c4c74eeb70019edde2b690c7e9d9744979a3b718d6687b3a83f00def

SHA512
4a450bcbce0eb3f98f78af07673227a55cdf8e7840fa892196cbb8d0f90551b32731f70f171644f8097fda97d57caa4b7430023671b19881764613231a20cdc9

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-synch-l1-1-0.dll

Filesize
20KB

MD5
99572ae21d1c8afe3d02f1124979e911

SHA1
5b17addc80b1406a3eaa615f5e37d92e953a0bb7

SHA256
e7d39dcb79d739ec030e9a4e2165b264a24c400566056e1fda267fdd1a8b36bd

SHA512
27ca8149d1f0c625de90a3f4cd4a4930ab0c1362ee10a7131ebfd2a88065c2a34c8ad7fb6d95ce33072146b9309488cbfe122984606d631b99d925e3fc42fcff

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
e4110aa5c8a32b63de2c85e0bc297c54

SHA1
6039680f47750cf56d0c9a1768de815a44b83de7

SHA256
01bb32d692b86ebb39a76893125e0f3aaf957c6e4bd682fb46eac32f6fb65be7

SHA512
0631ea8224403ca113dff9b17852e92c1fcb2820e4f335b668b12689d2a8f058ba33905692f2fd0f4897f8f766db816747ec95478d854b75a0803d2c899e6d98

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
19KB

MD5
a13048905fc64cd2103094c871c6d826

SHA1
cebb1a74bd5196a3fe174a20543335074a1b7397

SHA256
fb23439a5982e723e8e4ae1a5a35f9bbbfba1e76feb4596668f57093b231da6b

SHA512
e23effc6c17177d07f43955cc8ffa17ed05cc2c0a6430078b37de8536170dc3cb4f8970eba1049b10a789ab5acb423745f9d842dac4d63d5714751186a3f071d

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-timezone-l1-1-0.dll

Filesize
18KB

MD5
00b548bf3eab7a6debce296ee5e877de

SHA1
ae18022eb78c192ac3baee32664b9eb011194772

SHA256
d592b91a087c001f9ea38dc5912a90c78fad3a368879d04fd7e5650ed374c8dc

SHA512
3ba15d9a0f1680c2b182cf04fbbfcb0d4f1b607519c161c590928930ad1b3eba8bd417575a51305b9552f0abf0064c74267336ec09cea709aed9228e4eac799e

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-core-util-l1-1-0.dll

Filesize
18KB

MD5
96d9965ea02eefeadf1f122dfa724449

SHA1
c6f9eb1babe64b30fb1ff6b74e93db8ac41d1294

SHA256
4f31b2888ca82bd1ff40d71e2d11500456b99940dd469bfb097fcd304676fa38

SHA512
4018eae1e00899a5bd392c9b4f25561cf03292011f52387edd77058f49bd1b7456570f0108338088e5711bf5d6ba33aeb2c7bcd5d24d2744b173ff75bba0347b

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-conio-l1-1-0.dll

Filesize
19KB

MD5
032a139ea3cc41f2bb801cd580759a75

SHA1
4d88e10bcc4e75edc83bca578510d53fc827aa1a

SHA256
905f86530c56c9b453dd8bd9770440de0f6f35aa84b171de747a04d112e35aad

SHA512
4f574dfe92e90c7d6f162c0b69dd56c96031790abe15e52121c7e44980bbab86914ee06fc153fa5f3a77c4f1c6e4c24d7044507880a80b587872477708506a50

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-convert-l1-1-0.dll

Filesize
22KB

MD5
94e386a317faa200aa1dc270ce54e5fd

SHA1
e352ced285c04378bc3f6af4b30fa69df70b8974

SHA256
e4ccd13d5861e3e28984fc7263d79b580a0bc7bbe0d234ed8f1a69706ef908f3

SHA512
f622d303adecdce6ff88acc779d108556c2fdbe1f4140092d2d637c2fc1aaf651c1798291239e1334aabea702d7d380150922abd4e0122cbfc9c079a64dc0e76

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
e8ccecac4f06679b9d5e77333d216ee0

SHA1
377363813d0fc18083bdb0456a66efb6598a763a

SHA256
2cf24c6aac48261ab04eb616e85dd707417697764f860fc29dd3955dd2c49226

SHA512
e37db74e11138639e3bb02270589f977bfd803d450ff098d474ca461fd1fabc8e646a177a2082fd0a901fbe15225c4d352567a561c453f56ad8e0097838b945e

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
20KB

MD5
42153324a982f848d7a49bb7406125c2

SHA1
f0878690d23ad0c905f0a6ec37e9ea1edb813195

SHA256
fcd8b213e2e9962b84d1eec4296bbefdf4465398a235e118be12c878fdc08c05

SHA512
1710b3fd90210dd6603f2104de249704cad9d83acdc0c6b96ac24e20c4913679b1e4ee41bb7812d919ba76cadb36f7bd8210ee127325fd9db6b542cf2d0b7f69

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-heap-l1-1-0.dll

Filesize
19KB

MD5
aad41d33906cfdb31681ce8276648481

SHA1
6367d1990873c5af2f5d05d31ea083fb8b127883

SHA256
242cb185643df586a5f55735e8810b8d2b6b095c78be206e42cdaae7665bb2cf

SHA512
43b2cf09fcb13211f5bcab6942050e03dfb9ce36b727727f7c764df3754f332f04dc81f411e55caeecfa676c43dd1e977f29b0042c485babaaad609c239a84a9

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
bc75b80a80802146e79c383c94542f06

SHA1
7da2020a855ea6c003d905551a28af456e7519c2

SHA256
81a7a98e11ae94236f34a82a0d450a1100a9b8e752205248de0037a764b91a07

SHA512
0b6a8f6809f1a39c90bfe58ef0d05d997be307cb18771ff8fed6539bf7e19ee8cc3bedc44e1c22f34441db9b82a6470d3814fc7465d1ea82fa30d37278a0fe65

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-math-l1-1-0.dll

Filesize
28KB

MD5
1028042a84aefe816280f22a4517dc68

SHA1
b3437beb0e5a6a062678a0b32cea98f3c5e33580

SHA256
4a88f73cae12080b9a637f76f8ab1b8ac29829817ff03ddd611a25b6981ee573

SHA512
1da4a2d152943447950ae5de80360741c8a827647d1568c18b026376645f15cc9b5d1915dbdb43278adeac1423b20d6e1c97f6ad67ce724a0d91ec84c4e5250c

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
26KB

MD5
b7e1023ebbf0e5018c58b5488c03a643

SHA1
b10d3a570d4a44b87480d015aac4d04ef3f0a355

SHA256
e7238f5e38d3991e9d6219255e8cd951d6dd431402c4b4b295a68bd43efa3d48

SHA512
c5536416aeba4b37931e2961a29ea4c8679f6d942289325c9067d46b36797e404c0d8dfd01ce997e89bd42a7f084029d2f2d3cd7485b8cec5e66db50ac1df565

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-private-l1-1-0.dll

Filesize
71KB

MD5
538057da2c6ec8b927904346bb808792

SHA1
1156a3d1a653678b9f85aa64ff65bd3c10510b5e

SHA256
f8720e9250c5d5aace6918e1f67f6105f2cd08c0cf55633d2b6b28032d904e9a

SHA512
228531381ae55e7c1a24cfe36101325cd0b95899f2a125c72e82043f13248236171ad89a497e5b1d6c19a5febb8d2bd38cb43e81fbd753f3088aaee1c1791b7d

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-process-l1-1-0.dll

Filesize
19KB

MD5
4aa747ecc612240d522c23b51a8be7c1

SHA1
b037be0bc321e9329c7cf0dbf609fdb9b2d82fb4

SHA256
ecc116471ccfa09c599d389d71a574ebed01260b9760021a40665c4d8a22257d

SHA512
fb8c0d4f661fe6c8ce6cd04a3c0661a2f0b6058223edbfea811891aedd343d006c22a8524bf8508c2cc396853252477d5cf3c520889650a24d661f4964bce5c9

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
2f10f2255271b09d58af75f58476899c

SHA1
ca37f8e4c99fb178e718e99eed286d1ef32b00fc

SHA256
24bc147f7c8a2dfcbe9296d83ce75a1f2c02076d8f6e6c81f6032c927ed5888a

SHA512
74d85f5a40bd22eb9c85973bda5e596c3688096dc78fb6984f84ded4757ae82d77894c4cae0f24de77d211bbd869f9a4120a104d7c2ed161b4bb7b8568cf5103

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
24KB

MD5
65fe48962755451a1a5bab26e6fd978d

SHA1
d1322c477fe4ff61eedf9433b8deddee27f5adb9

SHA256
5a3d9a0a2c1f9b14cb52d9cce92b761ec1fe0460ea7d994179c96648455ead84

SHA512
940269af2c3a8b5b43ca936df1bb5338ae5166f04c34a163b5938895d19bdd7eadc156add1b96b5508e06088419a7d8f466f40bf01e64b4c547fbc1b20328ed7

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-string-l1-1-0.dll

Filesize
24KB

MD5
a3eccd7f2f2c45d1553055593278645a

SHA1
23cd6aed1b198ca515d7adb213efae780fbf0537

SHA256
d51dfd972e6df5e8185dce0b4eb26dccb0527c5f1c63bc081677335f69b92b67

SHA512
1dbf60f5df95e72b98b72faccb52f83585bc0bc5b1f65c259e8568d812461b738bb37c96e72e2f272370788cc7dcd7a8e5a698d9fb2c773ce0e17978c19ef858

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
c8f1a3b19e5103751202010805bce5c9

SHA1
179cf585ce939d05f9610d4b684e4dda6f452f76

SHA256
d5e2fb8495bbbfb66b2612cd5179c1a5f4746dcdd043ecd474363ffe4a8deb4f

SHA512
879fbe66e5440cbe01bd1814a36345fce6454196c8457969d2ee9e93b749df91d0d95b1da1d368063b7ef2a3ed538449b456eb2c7507a27de60105a0d37dcb71

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\api-ms-win-crt-utility-l1-1-0.dll

Filesize
18KB

MD5
e0aeba2d9d9ae584d6c1aa0f5929526b

SHA1
3f97b977d8877398d350b373fd441867167bd2ba

SHA256
4eca5b9e5be5750b0bc03fd74b6d5e351cb6d70fd63d5f740a1a122f906390e0

SHA512
cfa02a7afa052c5149a741500063f110462d272af417c33bedeac6ad3af424b181144c8045adc04a44a54dffca4639ae3c135f23d64bcfb66f7d3aa980143799

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\concrt140.dll

Filesize
238KB

MD5
bb7293add679a5688fcdd03f44de4b90

SHA1
4ffb7d8acd1bfec663d99694172c0c8c28a92900

SHA256
f3093cb216bf8ecc8d869e46d8cda3aaca28a326cb865ccbef329e1b13abc834

SHA512
ea094064c1454cceec03b4f54ad122be169c8bbfa6eece9b4f58eb6d59cbefa16af3a9b6f04461e438e4c208b6224a69a15c10cca6cf4cd5527cf0fe90052711

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\msvcp140.dll

Filesize
429KB

MD5
d25c3ff7a4cbbffc7c9fff4f659051ce

SHA1
02fe8d84d7f74c2721ff47d72a6916028c8f2e8a

SHA256
9c1dc36d319382e1501cdeaae36bad5b820ea84393ef6149e377d2fb2fc361a5

SHA512
945fe55b43326c95f1eee643d46a53b69a463a88bd149f90e9e193d71b84f4875455d37fd4f06c1307bb2cdbe99c1f6e18cb33c0b8679cd11fea820d7e728065

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\ucrtbase.dll

Filesize
899KB

MD5
015b30309491a911e75748ad69c9e680

SHA1
2f2243b6ea99689cd54e45b67d9b7d98847f904c

SHA256
dd32570b8183a8b117233333153da29cc8d2ac5b1c868440dd852d9c3f77baf5

SHA512
51159e407021ce78ad64ea91a5e53f59ee15d6d74b9c2891cd6dd532cae3f1d388198e0cd78648ce067e82fa7f01050b4773d95c5c827439f094b289f0ee0ac8

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\vccorlib140.dll

Filesize
261KB

MD5
60f11a76e35fd4a9cd2455ea3eff3224

SHA1
c86aa0a9864525b50a87555eb0c42af443b262d2

SHA256
f3bcc4a3ae6cd03e08ec48411b6927a0a163af6f92384279c1dd7afcb7f52293

SHA512
b996e29b9c91bd0a3303a597ecf958648fcafa3d5f0f5a22cc2aebb62714a482023e7a711cb2578f3f8937f802723942717009f98d9432ac7d44918f38fca25d

Download Submit
C:\Program Files (x86)\GameforgeClient\MSVC-CRT\vcruntime140.dll

Filesize
81KB

MD5
a2523ea6950e248cbdf18c9ea1a844f6

SHA1
549c8c2a96605f90d79a872be73efb5d40965444

SHA256
6823b98c3e922490a2f97f54862d32193900077e49f0360522b19e06e6da24b4

SHA512
2141c041b6bdbee9ec10088b9d47df02bf72143eb3619e8652296d617efd77697f4dc8727d11998695768843b4e94a47b1aed2c6fb9f097ffc8a42ca7aaaf66a

Download Submit
C:\Program Files (x86)\GameforgeClient\Qt5Core.dll

Filesize
4.9MB

MD5
be08bf63c8454be5dff48033c39772a4

SHA1
7a64a2cde850d1ed7876762c48d1e65ff266e3e2

SHA256
84d94018e037ed8824d4a9f8b3fa44f44ece6ea3351db1d21ab1355bc8fbc87a

SHA512
b6e523ee61a69112e0397f1c4157eb29f983827b0cda1e89350d8ff0d703670daec9dbaf49bceff5b039320865e8d1b576c827dc445a1848fc1069f3636fed00

Download Submit
C:\Program Files (x86)\GameforgeClient\Qt5Gui.dll

Filesize
5.0MB

MD5
4ecedcc841a597e08e51c12f1ff9cf72

SHA1
c81adb7de2c476fb4d2cd01afe360f87e32f9cdb

SHA256
11c26ac8cdaf842c8d723897569c81675b730418a666b2ae46b4b1a80312ec5d

SHA512
71bee391900bd82ec7d925656be9f8fc89c02be6ec4aa8b883f0f923582183568394e88636fb3b42c2e0fbb75287b7afffb10c219688d43b18f72d60f1c17630

Download Submit
C:\Program Files (x86)\GameforgeClient\Qt5Network.dll

Filesize
1021KB

MD5
405895b3481596104bddf4346559c396

SHA1
dbe11e76dd3f298ae3f85312ab892577f6a5ac00

SHA256
27caebc373f97c5c9332fa02ac0c9e18b8792e99549987cb32333681596cf541

SHA512
95b790a83fdc3c1a5a1b63665b2b6adbbd3039588f01cbe2556cf05cbf67bac2846a3c545ce9134feec41ddf13e1ebeaf4c53c30a91aab04a4c40e63fe138020

Download Submit
C:\Program Files (x86)\GameforgeClient\Qt5Qml.dll

Filesize
3.0MB

MD5
3add3ee27b6b48480969136f92f80b1d

SHA1
606f8e135498d57fbc2f10f6d82f9606863faa66

SHA256
98ec2a6a71d6d299db7e30b06d2bc0a75fadd3492b2d2a38e8a258d67ee904c1

SHA512
8c81130838b25eb24e3229f882fe7915c15d6048f0605c3378e71026979a02065bfb1e6b5f95639015d60bf46bccffd6e0515a53c4c10f8813afe770c1732a0f

Download Submit
C:\Program Files (x86)\GameforgeClient\Qt5Sql.dll

Filesize
171KB

MD5
28e8132db81e73094b3c29b22b16b943

SHA1
b777a64b310b3f2a6f420fff322e974fecbf03b9

SHA256
1873cade33e33a221245936b856bc076803784cf7d5dcdd7fcf91a39d5170d3b

SHA512
e0f13dca1a238d6a3d8bcdccba7b453eb4815853a66ebde1d599b3f8189209626c829a39fa358cd3a554e0ff422c3e46d92fdd75bd69cb973b3eead3753bdb6b

Download Submit
C:\Program Files (x86)\GameforgeClient\Qt5Svg.dll

Filesize
277KB

MD5
26158133670581eb145d54b9a0105fa2

SHA1
a321ef1036d81f69422db2a79902df4d4bd58c3b

SHA256
8b54dd0b3d4204875af59cd85fcad74cf3d8401419605f08481fb643a46b2a1b

SHA512
07445cbd3fdd82ffb7cd1c8beb5ea89cdc5ab1c7e4f90ef7f49ed30e34f6ad6345ed7f2e46f91cbe0a7f4cfbb1656dd684360d1e77dae186109b479b420a530f

Download Submit
C:\Program Files (x86)\GameforgeClient\Qt5WebChannel.dll

Filesize
105KB

MD5
663da220765e0e45badf606d4b41697d

SHA1
c56e21e721d9e77d97e9af6c5eeba89016ae3001

SHA256
097242c7ac9c685c50f88b316ddd2c21a736d65988ba425f8e45e6b9648cfb79

SHA512
8802b42fce8eaf71cf3b342d5613185afc0fae0523e78ecfc5c744b4f84d968a5001d9c5ddeb5738e38576e7dec8a6e9a65cc75893d0389da8aca02931ea5a08

Download Submit
C:\Program Files (x86)\GameforgeClient\Qt5Widgets.dll

Filesize
4.3MB

MD5
ead5499e9b9317e316bab101d2e83ca1

SHA1
77f2dbb196dd7717f4f0910fc72f1b8f187a8f53

SHA256
9a4005002668d6a01bc942ca2fa08a50e587e77a946cbde82536b965bb4534ac

SHA512
22b31530d2179ae1b009fc187fb70fed886a963f7bf8a54e76afd6d354d8a2229761746f34109857da6a6304ea84a0d96c14730fd7c1e3dd939323279cd87b66

Download Submit
C:\Program Files (x86)\GameforgeClient\Qt5WinExtras.dll

Filesize
245KB

MD5
8ad365be3c1fe44cafac93404dd1e097

SHA1
544d212359b13b84333b1166a2e19bcc4ee9c44d

SHA256
5e8ed66e25d70b1b933a3afb48b741b94aac680140b686c69f1d7bc7701e0a98

SHA512
deba7af335ecd5bd0cf60a963309c3d86d812cd9d74560511b0900e25b9c4f85a99210d1edb179e09e3c28b2953f9f372c82016caf1cabcad7be0d9ad0992a59

Download Submit
C:\Program Files (x86)\GameforgeClient\SparkWebHelper.exe

Filesize
331KB

MD5
4fab2da20a04c2d3c8456bd2545318fe

SHA1
d9e3b81bfc97c597a7672788ebac2cb8bda2144d

SHA256
92c68a49d831c781bb483d55bb306ed834515d6a0273364a344df3f71c2c2e79

SHA512
883a06b8ddaf3d504f74b85ac0128bc270fb3fe3ef1db5dab94fbf5d29f53c213ce7c1a93b13a961d377d71a0e7abd2f7771a4dde00d3955f93736f295530777

Download Submit
C:\Program Files (x86)\GameforgeClient\api-ms-win-core-console-l1-1-0.dll

Filesize
18KB

MD5
11e55839fcb3a53bdfed2a27fb7d5e80

SHA1
e585a1ed88696cd310c12f91ffa27f17f354b4f4

SHA256
f6bdc8ffd172b44f4d169707d9a457aeef619872661229b8629ee4f15eefff0d

SHA512
bec9419e35de03cc145b3c974833f73f1a5082d886de4739351b93bb4cc6c0234efd0e35ad845faba83fa600c4a7d5343eaae949a837d00d5528e6db79438ee4

Download Submit
C:\Program Files (x86)\GameforgeClient\chrome_elf.dll

Filesize
702KB

MD5
96bbb048b8ef84531552b70e22ff039c

SHA1
24c23e64dd10b58497a857782916ab3826daef94

SHA256
37b301b8bf3dc4dc17286ffea172409c9772ddc34465173f25c170ace03ec0ca

SHA512
68184339bcd3d7e266f3bbbc83c20b7dee437b8a57fcf16ed70c5b5a62d2927ce2273806753a448c3da1552c9e1215fecb38aad55691cdfedb503fed6131ba30

Download Submit
C:\Program Files (x86)\GameforgeClient\d3dcompiler_43.dll

Filesize
2.0MB

MD5
1c9b45e87528b8bb8cfa884ea0099a85

SHA1
98be17e1d324790a5b206e1ea1cc4e64fbe21240

SHA256
2f23182ec6f4889397ac4bf03d62536136c5bdba825c7d2c4ef08c827f3a8a1c

SHA512
b76d780810e8617b80331b4ad56e9c753652af2e55b66795f7a7d67d6afcec5ef00d120d9b2c64126309076d8169239a721ae8b34784b639b3a3e2bf50d6ee34

Download Submit
C:\Program Files (x86)\GameforgeClient\d3dcompiler_47.dll

Filesize
3.5MB

MD5
587a415cd5ac2069813adef5f7685021

SHA1
ca0e2fe1922b3cdc9e96e636a73e5c85a838e863

SHA256
2ad0d4987fc4624566b190e747c9d95038443956ed816abfd1e2d389b5ec0851

SHA512
0fa0e89ea1c1cb27ac7f621feb484438e378a8f5675eca7a91f24e0569174bd848d470d6b3e237fe6ab27ca1eb1ecc09b5f044e53a6d98bf908e77ac511183e2

Download Submit
C:\Program Files (x86)\GameforgeClient\gameforge_client_api.dll

Filesize
267KB

MD5
b2d4bbb374c4ebd72c71196e752f1b06

SHA1
8d8a1228f84dc7b5c16de93199ba5229052f6a06

SHA256
f8697a16ae00404b5754f10773da6d13eb2d710a46d450e988f5f44fa5d07ee7

SHA512
f3c16c986b0c3a1cfcf0e6d52fc9461fc106527e6a25d895815d627dffecc1ad6aa3ec2cc7a2daf89789dbe3140d500dc73bc83e2a31f1094b5bf238cebb5efc

Download Submit
C:\Program Files (x86)\GameforgeClient\gfHelper.exe

Filesize
347KB

MD5
06e4acbcd6cb1fa1150683236a937757

SHA1
9dc37450527754c291bf1058e83cd31abe7ab90c

SHA256
73d0235998368836862572ca49962f345e18506eaa54d8e1ca2cbd59a01a3e90

SHA512
348e68e87bc1e383d8288a2b3817a6a9a89b37e60bd116312ecf2834daee181ac877fa93e75d7bf24267c6fab35c40dbd863da300aed8d7a04aa74be2970c822

Download Submit
C:\Program Files (x86)\GameforgeClient\gfclient.exe

Filesize
4.1MB

MD5
ee3e9ce575195c0b4854503244b4d4c2

SHA1
e6f858aee1ce954d8522b9af3ea3a45d615bcbd7

SHA256
597199396418d196b754805dd9a910f183a91d145e1fd57f88a40fdab6844600

SHA512
93f463736f338338aba14ad542474b2db51e58cd32ac21f7072f8974c1e0f9445846b99db8b19e76662fe77d8b6c217021fb370f7f0fc0d4fccd540e06db4faa

Download Submit
C:\Program Files (x86)\GameforgeClient\gfservice.exe

Filesize
621KB

MD5
595adc25416f4fbd5c6a4db93c868431

SHA1
8c7fd55ae785189acd209283b8202f13ad0a8517

SHA256
922940139a56e8df0a4dbe85c32b5b1833bf10d10b970c2ba1cc840a15482faf

SHA512
bd380bfd770f9f18b78325a664513c385953993ea711b3d67816d7d73542541d2ec03136da27e4e1363f2044f621e5a5f1f48bf39657fa4832f159d3de6c04c6

Download Submit
C:\Program Files (x86)\GameforgeClient\libEGL.dll

Filesize
104KB

MD5
6fced98e1a9c384341aef562549663c6

SHA1
6cbbbd5f330d8517bb391c6f6cbf2ab2de82c575

SHA256
0d0d08b0d8d875aaafbe8daff496bf15be582d9c1efa2d89856f5f3a82e4873b

SHA512
2bd8ac5b5b4d089cbfd454550b075b40dd6ab9a6fca228c7b4c2ac5096dce5145dc634ca3362fd6e4635898e14c1bc90f9eea943ebe545c70c82349e2a71405a

Download Submit
C:\Program Files (x86)\GameforgeClient\libGLESv2.dll

Filesize
4.2MB

MD5
3c6fd43e8e5960bc77ae52124095656f

SHA1
fe8301de6a24886d790d7518972b179510701b75

SHA256
f6eebd31394e23a729f5a1f5fbcb693a30119ca5fdff56887ec5f47cc22c84b4

SHA512
cd1f490b436d30d2578997c6a5db06d56a75dc91af41f9e1d2fd5a1052d4454b1f1451b6d7317621a1055eb11ee2c442a0f4f1aeb330c1ce1b7bae7e6cf4acf5

Download Submit
C:\Program Files (x86)\GameforgeClient\libcurl.dll

Filesize
359KB

MD5
acc5b60f94aa02324d3b2594c0cc7460

SHA1
73884463f9e4347bcc42029e2580a8afbf4bfffd

SHA256
dad90c15ee8c8e682c84f334297b5209b0e7a1e94a8f5e07821905173c3b8b17

SHA512
253161503783ba0c08225dcd2716058ad57981eb68b75200f790b92ce78b473292bf34e1946760e10b08e19a58ca190fb592424377c49d04b8b2e59be82ab9e5

Download Submit
C:\Program Files (x86)\GameforgeClient\libeay32.dll

Filesize
1.2MB

MD5
c83eca4dcffc06caef29a10be5779c89

SHA1
a8fac80942ae8c21126bb6ae4ba0db7602a3edfd

SHA256
dbccbeb4b47f6817c8b62c73343aa65071ce5313e128cac40c4d6a8900e68a05

SHA512
8b5921ab9d482ec25e9c9d47ed2ea98941641530a6514041186cd96814ff47e3cb88646df00dc32a0fca83c9bb3b3ba93ece5b18e1f8d555e382cd4b61dc0db1

Download Submit
C:\Program Files (x86)\GameforgeClient\log4qt.dll

Filesize
385KB

MD5
a02e7ae49b343a329c963df868cbe4c6

SHA1
2957a7164856f357f29e8b3606fea63bce3496d3

SHA256
fcd0e0e215c63986550d96988eab2af5acdb32bceb3503444a7d853417861c14

SHA512
a31cf38d5f250853fc15842e8c240daf5c33a13fef70c2b42a2a7f8c4dabd54bb3825d47f80c7366b33792140d821516fb69c71d844a39fa66d78e6999cfc263

Download Submit
C:\Program Files (x86)\GameforgeClient\platforms\qwindows.dll

Filesize
1.1MB

MD5
a91f18a844fc6cfa8064546b03223347

SHA1
19926bc68a92532aa46abedc8ec1c887e41d06b0

SHA256
7fffdbc486e0310922bae73a2a1246a9c16aae3ba273c5d1bc4f2827c8272930

SHA512
2c04530fa6a9e0aa25b83de52557b33789d623c8558193d7177074a3416e6e0dc2e7a494e0ba860add0a0326226401612af50a636f786a84fc5286dfa4d541eb

Download Submit
C:\Program Files (x86)\GameforgeClient\qjsonrpc1.dll

Filesize
207KB

MD5
e1c5c2faabd7de5bbc7bd41772bc882c

SHA1
6692a66323a8e9be9a1bd60c16ca4dd54254f04f

SHA256
98f18e42864b31ecf786a0df5518744c40022bbb9054b166251f4d1d6a2cee74

SHA512
5588e1e8541c7cce0fc2945105d965b8bd2f1cc54d254702c4b9a142e7734ddf694d3b0dd120f4fa41af7d6e7b67adc131e83c6ee79f55015027cf7ade273f01

Download Submit
C:\Program Files (x86)\GameforgeClient\qtservice.dll

Filesize
61KB

MD5
ef552eecebe73821861c2910a806ec1a

SHA1
ae246a7fb6cff282ffa9d89ca005284bff200851

SHA256
c0326206ecc8a3515a7d7b34a2a8be14f0a6386268a5a44e2fba359f447f0e30

SHA512
bc16d56eba3fc1246cbbbd3850f4f473a7610b69f65c89442e94de1aef02e0fda46d39f730d22be815399cd9aaf901cd150885e98ad9454d716e747a56b743ec

Download Submit
C:\Program Files (x86)\GameforgeClient\ssleay32.dll

Filesize
288KB

MD5
3d80e5030bb5e702f33879714f78888d

SHA1
a42c531413bb6eb2f341b86016dcd325f98d355d

SHA256
e1e54c40204fb63c30716be9613814d930b6a1b705076a0b047a0dab938ba096

SHA512
0463ef3e9ed243ce40701e331f50666462deed421b48f25996ad43f94bf33dca04cf0103e2d7462cf6870cd1b1b48da980c660295b2b60acb5dbacad976406a3

Download Submit
C:\Program Files (x86)\GameforgeClient\styles\qwindowsvistastyle.dll

Filesize
121KB

MD5
00340ca804e682eecb8ea5b8e4057575

SHA1
5d75d3d30a2aaff2c3ff90ecd0c772c47f57d4b5

SHA256
75e27daea42c488b79bd00d3ce321a41ff4184c1a62802e55b0d97f8343b7989

SHA512
0c09845050df26f0a1ec6b1ff07b5fa8dade871aa39045ea59e16f209ac36053bdd22905b7c8fec7484f0a566db42c979a8f08124bb403da8b0ef2e1b722b27e

Download Submit
C:\Program Files (x86)\GameforgeClient\translations\client_en_US.qm

Filesize
75KB

MD5
db521b7139228c38ecc4e248aa9c3739

SHA1
a64d27f8c701bf725dd3c3dbb1841addb9a1fb6a

SHA256
cff0c8e52a96bd2b39bb010f27bdae8dd4fe9abc57198c04b4fc4f1f932afc3c

SHA512
364cfb2fb35eb44509f96340839851ac607098275289f6e98f2e2fd644f3a9f073ef07374fce6c010531517eb6a514f4b012dc6a12420ef5d4f707bac9f1708f

Download Submit
C:\Program Files (x86)\GameforgeClient\vcredist_x86.exe

Filesize
13.8MB

MD5
a3cb49daa1347ffe34b517f1a12f40ab

SHA1
72211bd2e7dfc91ea7c8fac549c49c0543ba791b

SHA256
12a69af8623d70026690ba14139bf3793cc76c865759cad301b207c1793063ed

SHA512
e3d96cc4c822793893fc3831cbe40d7a53ee8eca3a73021aea2193bbf5c5a05ef5fa4a9fc314c29ad5392f980997a25507caa9cf3a1e3362674ac913fbaebb17

Download Submit
C:\Program Files (x86)\GameforgeClient\xdelta3.exe

Filesize
238KB

MD5
35d1b358081e20204c8beb1993434a49

SHA1
84223a2fc83db0768fe642623aef730926cc07e6

SHA256
7a8447f6e4ee96a8188e4d34b8d02e531f34e52fb4cd2bec4c0f9af605a627fa

SHA512
da9d57f95bcb4741bee1f2d0caa23269f1825f3eb5ad79d40b6c3ef1d48269950ac2d749b16d58cada4da1c6cb198ce019ffc6b1572c0b8d85f2f643031a51f2

Download Submit
C:\Users\Admin\AppData\Local\Gameforge4d\GameforgeClient\crashes\gfClient\441da513-7518-441e-614f-d5585361902b.run\session.json

Filesize
219B

MD5
afcd9b8f0e1769eba2ec067ec92ccbb9

SHA1
9943a251f5b3900aa88f2a32bb8bfba42515912d

SHA256
08eb4be48752bd0f543ed52a841ee3521923b8b3adc46f92a5434d648fcf3206

SHA512
c880efde3f06d0edd01e70e1d2aec7d2a4f11ccd7ecbacf16c943f3f0c5ea1ce504ace5864ab8753f11219ed971448d1bd3ebaba42edd0edc467b50b5e3d4ea9

Download Submit
C:\Users\Admin\AppData\Local\Gameforge4d\GameforgeClient\webcache\Code Cache\js\index-dir\temp-index

Filesize
192B

MD5
4883de071a2f56b7d85e598dbf5bdc77

SHA1
e9f1efa771d688864db8f893b953811277947c77

SHA256
6c4273974b17b5283cf7e01d092de24df37d991b557eaa9ac63a223fef8ceec1

SHA512
8b706446f5b702ba5c964897438914c4edc2f9aab72c93ff052ff6d9a0888ad923b6e6d7b9101b06987b9048e2352786e088247831a7d9428844fe5014a2f7f5

Download Submit
C:\Users\Admin\AppData\Local\Gameforge4d\GameforgeClient\webcache\Code Cache\js\index-dir\the-real-index~RFe57ff01.TMP

Filesize
48B

MD5
f38626178e6e60202a205d1cbda7446c

SHA1
958e08b780522bb9f60ff9740f542eea2717d05c

SHA256
91028a44ca6499eea2561da146744066ff2ed159cefdb11e3fd53ee4dac72e8c

SHA512
07ee17a3a5fea740e81964040a86a4d0d8cdf8c0068bf9761bc1d0165e5d29563a31be10f9cc1ace98007b09c385871550e3e3dcaa7938fdfbba181758e17e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VR4CG.tmp\GameforgeLoginSetup.tmp

Filesize
2.6MB

MD5
978e1c2a61aa0730b7a0030b38858793

SHA1
f199e78154bf3d8fe79b67aa0a9836cb912500bb

SHA256
9d8458625087bfc99af6b748b9d5928852cdf2521d339c44f1ec7e2a8d613579

SHA512
4ff5ea2a9601569686b1b4b90d60a22cb350b0db0d5b47fb762c7de1e6bb17af100bb06f07fe20b0be8748dbe673d681734e59f779ab3f0df7b2f89f84e999fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\wixstdba.dll

Filesize
118KB

MD5
4d20a950a3571d11236482754b4a8e76

SHA1
e68bd784ac143e206d52ecaf54a7e3b8d4d75c9c

SHA256
a9295ad4e909f979e2b6cb2b2495c3d35c8517e689cd64a918c690e17b49078b

SHA512
8b9243d1f9edbcbd6bdaf6874dc69c806bb29e909bd733781fde8ac80ca3fff574d786ca903871d1e856e73fd58403bebb58c9f23083ea7cd749ba3e890af3d2

Download Submit
C:\Windows\Temp\Gameforge4d\GameforgeService\crashes\92620a3a-2ada-4bcc-37e9-50a169b0ed7b.run\session.json

Filesize
219B

MD5
5ad8e3d7b76858ad4ea15bf91c9761ab

SHA1
df3236d8e908e1d2c0ae345aff74aafa6356c4e8

SHA256
e6bad774f60e8715b26070df3e210c703666d4e9bd1003ebe2f6a960637dfc52

SHA512
c88db5b6dff4f22f3ef492e6f8f228e399882617a41cf0f3769ec8d85f965ff6a79f246765d1a409af81ad1943ec3da85e60a377b08dca86e2ea0d5b930c7ec0

Download Submit
memory/1912-824-0x0000000000400000-0x00000000006AC000-memory.dmp

Filesize
2.7MB

Download
memory/1912-14-0x0000000000400000-0x00000000006AC000-memory.dmp

Filesize
2.7MB

Download
memory/3860-825-0x0000000000400000-0x00000000004F1000-memory.dmp

Filesize
964KB

Download
memory/3860-6-0x0000000000400000-0x00000000004F1000-memory.dmp

Filesize
964KB

Download
memory/3860-9-0x0000000000401000-0x00000000004A9000-memory.dmp

Filesize
672KB

Download