ac9ac5a95273064ba09af8be049124ba52db7a59075d69a94d12427917dbc376

Analysis

max time kernel
128s
max time network
134s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gameguard_setup.msi
Size

7.7MB
MD5

68bd8f9af44479db013a77c806f1c674
SHA1

0cbb2b63c78b42e13b1818964bb2cf43e46c5052
SHA256

ac9ac5a95273064ba09af8be049124ba52db7a59075d69a94d12427917dbc376
SHA512

991f703293b984beeeda44cc72cacc0cd69bd4cb1856b2b1c5cf2a2d06d7f58e8469af70c2ecece05d98643937c52f8a944b9892e2925738457d2ac238867852
SSDEEP

196608:mELpCPNYnYCCJLuMo3nmkmKf+GNI1Xjn5CD9ilxw:fLpCVY7CtuMo2kmcNmsiLw

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

gguard.exe

description ioc process

File created C:\Windows\system32\drivers\acdrv.sys gguard.exe
Blocklisted process makes network request 2 IoCs

Processes:

msiexec.exemsiexec.exe

flow pid process

3 2148 msiexec.exe
5 1104 msiexec.exe

description	ioc	process
File created	C:\Windows\system32\drivers\acdrv.sys	gguard.exe

flow	pid	process
3	2148	msiexec.exe
5	1104	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

Processes:

gameguard.exegameguard.exegguard.exeggbfggpoox.exe

pid process

2756 gameguard.exe
2756 gameguard.exe
2196 gameguard.exe
2196 gameguard.exe
1500 gguard.exe
1500 gguard.exe
2900 ggbfggpoox.exe
2900 ggbfggpoox.exe

pid	process
2756	gameguard.exe
2756	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
1500	gguard.exe
1500	gguard.exe
2900	ggbfggpoox.exe
2900	ggbfggpoox.exe

Drops file in Program Files directory 16 IoCs

Processes:

gameguard.exemsiexec.exegameguard.exegguard.exeacsvc.exe

description	ioc	process
File created	C:\Program Files (x86)\GameGuard\launcher_x64	gameguard.exe
File created	C:\Program Files (x86)\GameGuard\gameguard.exe	msiexec.exe
File created	C:\Program Files (x86)\GameGuard\cache\duhbmuv.cache	gameguard.exe
File created	C:\Program Files (x86)\GameGuard\cache\dpcmgsl.cache	gameguard.exe
File created	C:\Program Files (x86)\GameGuard\steam_api.dll	gameguard.exe
File created	C:\Program Files (x86)\GameGuard\steam_appid.txt	gameguard.exe
File created	C:\Program Files (x86)\GameGuard\ggbfggpoox.exe	gguard.exe
File created	C:\Program Files (x86)\GameGuard\cache\yfoaqy.cache	gameguard.exe
File created	C:\Program Files (x86)\GameGuard\cache\qhkvjsfb.cache	gameguard.exe
File created	C:\Program Files (x86)\GameGuard\cache\yiwicrme.cache	gameguard.exe
File created	C:\Program Files (x86)\GameGuard\gameguard.exe	acsvc.exe
File opened for modification	C:\Program Files (x86)\GameGuard\gameguard.exe	acsvc.exe
File created	C:\Program Files (x86)\GameGuard\acsvc.exe	msiexec.exe
File created	C:\Program Files (x86)\GameGuard\acsvc.exe	gameguard.exe
File opened for modification	C:\Program Files (x86)\GameGuard\acsvc.exe	gameguard.exe
File created	C:\Program Files (x86)\GameGuard\gguard.exe	gameguard.exe

Drops file in Windows directory 12 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\{DB58A440-02BB-433B-AE99-D0B8AF31A839}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f772e60.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f772e60.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{DB58A440-02BB-433B-AE99-D0B8AF31A839}\icon.ico	msiexec.exe
File created	C:\Windows\Installer\f772e61.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI33C8.tmp	msiexec.exe
File created	C:\Windows\Installer\f772e63.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f772e61.ipi	msiexec.exe

Executes dropped EXE 7 IoCs

Processes:

acsvc.exegameguard.exeacsvc.exeacsvc.exegameguard.exegguard.exeggbfggpoox.exe

pid process

1596 acsvc.exe
2756 gameguard.exe
1572 acsvc.exe
2860 acsvc.exe
2196 gameguard.exe
1500 gguard.exe
2900 ggbfggpoox.exe
Loads dropped DLL 7 IoCs

Processes:

MsiExec.exegameguard.exeacsvc.exegameguard.exegguard.exe

pid process

2780 MsiExec.exe
2756 gameguard.exe
2860 acsvc.exe
2860 acsvc.exe
2196 gameguard.exe
1500 gguard.exe
1500 gguard.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
persistence privilege_escalation

Installer Packages
T1546.016

Msiexec
T1218.007

Processes:

msiexec.exe

pid process

2148 msiexec.exe

pid	process
1596	acsvc.exe
2756	gameguard.exe
1572	acsvc.exe
2860	acsvc.exe
2196	gameguard.exe
1500	gguard.exe
2900	ggbfggpoox.exe

pid	process
2780	MsiExec.exe
2756	gameguard.exe
2860	acsvc.exe
2860	acsvc.exe
2196	gameguard.exe
1500	gguard.exe
1500	gguard.exe

pid	process
2148	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

acsvc.exegameguard.exegguard.exeggbfggpoox.exeIEXPLORE.EXEMsiExec.exegameguard.exeacsvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gameguard.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gguard.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ggbfggpoox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gameguard.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acsvc.exe

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EB07EBF1-7826-11EF-B5A6-7A9F8CACAEA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 46 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe

Modifies registry class 46 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ggac\shell\open\command\ = "\"C:\\Program Files (x86)\\GameGuard\\\\gameguard.exe\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\gameguard	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gameguard\shell\open\command\ = "\"C:\\Program Files (x86)\\GameGuard\\\\gameguard.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ggac\shell	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\ProductIcon = "C:\\Windows\\Installer\\{DB58A440-02BB-433B-AE99-D0B8AF31A839}\\icon.ico"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gameguard\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ggac\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gameguard\ = "URL:GameGuard Protocol"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gameguard\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gameguard\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\044A85BDBB20B334EA990D8BFA138A93	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\044A85BDBB20B334EA990D8BFA138A93\ProductFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\14D8C6FEA992C334C8E1F1E30B83F8E1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\gameguard\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ggac\ = "URL:GameGuard Protocol"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ggac\DefaultIcon\ = "C:\\Program Files (x86)\\GameGuard\\\\gameguard.exe,1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ggac\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ggac	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gameguard\DefaultIcon\ = "C:\\Program Files (x86)\\GameGuard\\\\gameguard.exe,1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gameguard\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ggac	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\14D8C6FEA992C334C8E1F1E30B83F8E1\044A85BDBB20B334EA990D8BFA138A93	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\PackageCode = "FCF74D9E87639FE42A3F49F0B413967A"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ggac\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\ProductName = "GameGuard"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ggac\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\044A85BDBB20B334EA990D8BFA138A93\DesktopShortcutFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\SourceList\PackageName = "gameguard_setup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\044A85BDBB20B334EA990D8BFA138A93\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\gameguard\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gameguard	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ggac\URL Protocol	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exegameguard.exegameguard.exegguard.exeggbfggpoox.exe

pid	process
1104	msiexec.exe
1104	msiexec.exe
2756	gameguard.exe
2756	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
1500	gguard.exe
1500	gguard.exe
2900	ggbfggpoox.exe
1500	gguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe
2196	gameguard.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

476

pid	process
476

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	2148	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2148	msiexec.exe
Token: SeRestorePrivilege	1104	msiexec.exe
Token: SeTakeOwnershipPrivilege	1104	msiexec.exe
Token: SeSecurityPrivilege	1104	msiexec.exe
Token: SeCreateTokenPrivilege	2148	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2148	msiexec.exe
Token: SeLockMemoryPrivilege	2148	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2148	msiexec.exe
Token: SeMachineAccountPrivilege	2148	msiexec.exe
Token: SeTcbPrivilege	2148	msiexec.exe
Token: SeSecurityPrivilege	2148	msiexec.exe
Token: SeTakeOwnershipPrivilege	2148	msiexec.exe
Token: SeLoadDriverPrivilege	2148	msiexec.exe
Token: SeSystemProfilePrivilege	2148	msiexec.exe
Token: SeSystemtimePrivilege	2148	msiexec.exe
Token: SeProfSingleProcessPrivilege	2148	msiexec.exe
Token: SeIncBasePriorityPrivilege	2148	msiexec.exe
Token: SeCreatePagefilePrivilege	2148	msiexec.exe
Token: SeCreatePermanentPrivilege	2148	msiexec.exe
Token: SeBackupPrivilege	2148	msiexec.exe
Token: SeRestorePrivilege	2148	msiexec.exe
Token: SeShutdownPrivilege	2148	msiexec.exe
Token: SeDebugPrivilege	2148	msiexec.exe
Token: SeAuditPrivilege	2148	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2148	msiexec.exe
Token: SeChangeNotifyPrivilege	2148	msiexec.exe
Token: SeRemoteShutdownPrivilege	2148	msiexec.exe
Token: SeUndockPrivilege	2148	msiexec.exe
Token: SeSyncAgentPrivilege	2148	msiexec.exe
Token: SeEnableDelegationPrivilege	2148	msiexec.exe
Token: SeManageVolumePrivilege	2148	msiexec.exe
Token: SeImpersonatePrivilege	2148	msiexec.exe
Token: SeCreateGlobalPrivilege	2148	msiexec.exe
Token: SeBackupPrivilege	2004	vssvc.exe
Token: SeRestorePrivilege	2004	vssvc.exe
Token: SeAuditPrivilege	2004	vssvc.exe
Token: SeBackupPrivilege	1104	msiexec.exe
Token: SeRestorePrivilege	1104	msiexec.exe
Token: SeRestorePrivilege	2840	DrvInst.exe
Token: SeRestorePrivilege	2840	DrvInst.exe
Token: SeRestorePrivilege	2840	DrvInst.exe
Token: SeRestorePrivilege	2840	DrvInst.exe
Token: SeRestorePrivilege	2840	DrvInst.exe
Token: SeRestorePrivilege	2840	DrvInst.exe
Token: SeRestorePrivilege	2840	DrvInst.exe
Token: SeLoadDriverPrivilege	2840	DrvInst.exe
Token: SeLoadDriverPrivilege	2840	DrvInst.exe
Token: SeLoadDriverPrivilege	2840	DrvInst.exe
Token: SeRestorePrivilege	1104	msiexec.exe
Token: SeTakeOwnershipPrivilege	1104	msiexec.exe
Token: SeRestorePrivilege	1104	msiexec.exe
Token: SeTakeOwnershipPrivilege	1104	msiexec.exe
Token: SeRestorePrivilege	1104	msiexec.exe
Token: SeTakeOwnershipPrivilege	1104	msiexec.exe
Token: SeRestorePrivilege	1104	msiexec.exe
Token: SeTakeOwnershipPrivilege	1104	msiexec.exe
Token: SeRestorePrivilege	1104	msiexec.exe
Token: SeTakeOwnershipPrivilege	1104	msiexec.exe
Token: SeRestorePrivilege	1104	msiexec.exe
Token: SeTakeOwnershipPrivilege	1104	msiexec.exe
Token: SeRestorePrivilege	1104	msiexec.exe
Token: SeTakeOwnershipPrivilege	1104	msiexec.exe
Token: SeRestorePrivilege	1104	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

msiexec.exegameguard.exeggbfggpoox.exeiexplore.exegameguard.exe

pid process

2148 msiexec.exe
2148 msiexec.exe
2756 gameguard.exe
2756 gameguard.exe
2900 ggbfggpoox.exe
2172 iexplore.exe
2196 gameguard.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

gameguard.exeggbfggpoox.exegameguard.exe

pid process

2756 gameguard.exe
2756 gameguard.exe
2900 ggbfggpoox.exe
2196 gameguard.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

ggbfggpoox.exeverifier.exeiexplore.exeIEXPLORE.EXE

pid process

2900 ggbfggpoox.exe
2420 verifier.exe
2172 iexplore.exe
2172 iexplore.exe
2616 IEXPLORE.EXE
2616 IEXPLORE.EXE
2616 IEXPLORE.EXE
2616 IEXPLORE.EXE

pid	process
2148	msiexec.exe
2148	msiexec.exe
2756	gameguard.exe
2756	gameguard.exe
2900	ggbfggpoox.exe
2172	iexplore.exe
2196	gameguard.exe

pid	process
2756	gameguard.exe
2756	gameguard.exe
2900	ggbfggpoox.exe
2196	gameguard.exe

pid	process
2900	ggbfggpoox.exe
2420	verifier.exe
2172	iexplore.exe
2172	iexplore.exe
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

msiexec.exeMsiExec.exeacsvc.exeacsvc.exegameguard.exegguard.exeiexplore.exe

description	pid	process	target process
PID 1104 wrote to memory of 2780	1104	msiexec.exe	MsiExec.exe
PID 1104 wrote to memory of 2780	1104	msiexec.exe	MsiExec.exe
PID 1104 wrote to memory of 2780	1104	msiexec.exe	MsiExec.exe
PID 1104 wrote to memory of 2780	1104	msiexec.exe	MsiExec.exe
PID 1104 wrote to memory of 2780	1104	msiexec.exe	MsiExec.exe
PID 1104 wrote to memory of 2780	1104	msiexec.exe	MsiExec.exe
PID 1104 wrote to memory of 2780	1104	msiexec.exe	MsiExec.exe
PID 2780 wrote to memory of 2756	2780	MsiExec.exe	gameguard.exe
PID 2780 wrote to memory of 2756	2780	MsiExec.exe	gameguard.exe
PID 2780 wrote to memory of 2756	2780	MsiExec.exe	gameguard.exe
PID 2780 wrote to memory of 2756	2780	MsiExec.exe	gameguard.exe
PID 1572 wrote to memory of 2860	1572	acsvc.exe	acsvc.exe
PID 1572 wrote to memory of 2860	1572	acsvc.exe	acsvc.exe
PID 1572 wrote to memory of 2860	1572	acsvc.exe	acsvc.exe
PID 1572 wrote to memory of 2860	1572	acsvc.exe	acsvc.exe
PID 2860 wrote to memory of 2196	2860	acsvc.exe	gameguard.exe
PID 2860 wrote to memory of 2196	2860	acsvc.exe	gameguard.exe
PID 2860 wrote to memory of 2196	2860	acsvc.exe	gameguard.exe
PID 2860 wrote to memory of 2196	2860	acsvc.exe	gameguard.exe
PID 2196 wrote to memory of 1500	2196	gameguard.exe	gguard.exe
PID 2196 wrote to memory of 1500	2196	gameguard.exe	gguard.exe
PID 2196 wrote to memory of 1500	2196	gameguard.exe	gguard.exe
PID 2196 wrote to memory of 1500	2196	gameguard.exe	gguard.exe
PID 1500 wrote to memory of 2900	1500	gguard.exe	ggbfggpoox.exe
PID 1500 wrote to memory of 2900	1500	gguard.exe	ggbfggpoox.exe
PID 1500 wrote to memory of 2900	1500	gguard.exe	ggbfggpoox.exe
PID 1500 wrote to memory of 2900	1500	gguard.exe	ggbfggpoox.exe
PID 1500 wrote to memory of 2420	1500	gguard.exe	verifier.exe
PID 1500 wrote to memory of 2420	1500	gguard.exe	verifier.exe
PID 1500 wrote to memory of 2420	1500	gguard.exe	verifier.exe
PID 1500 wrote to memory of 2420	1500	gguard.exe	verifier.exe
PID 2196 wrote to memory of 2172	2196	gameguard.exe	iexplore.exe
PID 2196 wrote to memory of 2172	2196	gameguard.exe	iexplore.exe
PID 2196 wrote to memory of 2172	2196	gameguard.exe	iexplore.exe
PID 2196 wrote to memory of 2172	2196	gameguard.exe	iexplore.exe
PID 2172 wrote to memory of 2616	2172	iexplore.exe	IEXPLORE.EXE
PID 2172 wrote to memory of 2616	2172	iexplore.exe	IEXPLORE.EXE
PID 2172 wrote to memory of 2616	2172	iexplore.exe	IEXPLORE.EXE
PID 2172 wrote to memory of 2616	2172	iexplore.exe	IEXPLORE.EXE

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\gameguard_setup.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2148

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding ADA452A533A7BA31DFB2A01B0DC73885 C
2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2780

C:\Program Files (x86)\GameGuard\gameguard.exe
"C:\Program Files (x86)\GameGuard\gameguard.exe"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2756

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2004

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003DC" "00000000000005A0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2840

C:\Program Files (x86)\GameGuard\acsvc.exe
"C:\Program Files (x86)\GameGuard\acsvc.exe"
1⤵
- Executes dropped EXE
PID:1596

C:\Program Files (x86)\GameGuard\acsvc.exe
"C:\Program Files (x86)\GameGuard\acsvc.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1572

C:\Program Files (x86)\GameGuard\acsvc.exe
"C:\Program Files (x86)\GameGuard\acsvc.exe" --run="C:\Program Files (x86)\GameGuard\gameguard.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860

C:\Program Files (x86)\GameGuard\gameguard.exe
"C:\Program Files (x86)\GameGuard\gameguard.exe"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2196

C:\Program Files (x86)\GameGuard\gguard.exe
".\gguard.exe"
4⤵
- Drops file in Drivers directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1500

C:\Program Files (x86)\GameGuard\ggbfggpoox.exe
"C:\Program Files (x86)\GameGuard\ggbfggpoox.exe"
5⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2900

C:\Windows\system32\verifier.exe
C:\Windows\system32\verifier.exe /volatile /removedriver acdrv.sys
5⤵
- Suspicious use of SetWindowsHookEx
PID:2420

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.microsoft.com/en-us/download/details.aspx?id=46148
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
5⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f772e62.rbs

Filesize
10KB

MD5
5dd681aec1b061a93d6887d69f891284

SHA1
8aa259fc86de3fbc858757ff2084a5489141e1cb

SHA256
a7bb54a71cf686cd40717a005796dedd5e5210636da8e226e9d85d5eca9f4595

SHA512
4d1ba36cf82fde4d35f5d7a64761e18db8508ad07de8474ae51015ee793faa18829e3a862aa29e63158d8a6bf619f664af817178e7c75a9a6f6be7c2ac824259

Download Submit
C:\Program Files (x86)\GameGuard\acsvc.exe

Filesize
316KB

MD5
7ec55f85dd4740e6f146d3ee54e01201

SHA1
44fcf3bb83a006ab6ca90d728bec43c031e0cada

SHA256
7997c3e9c03c0e91b8b07cb482c97066afdd483d2dbab1f292f749f4fe97e229

SHA512
7b6a494b5506e249e67e63c32fe42895227ec53a49f37e9b3884f628fd7bcc29f1f8bf96d616b8b741adc48540fc8eda7e64701a459acb707569bd1e36ee143b

Download Submit
C:\Program Files (x86)\GameGuard\acsvc.exe

Filesize
330KB

MD5
b966184ae28d7bc96756bc3ed001c701

SHA1
8c620632624e9bc9b3e7d7a672072bdb6952df87

SHA256
f2b6185392b98f27da4a7a8c74b585ae00d6e69bd7f97727dca0953aa3ab0324

SHA512
8b9ad0bec94ed9a44a0c8aa8b8ca1b80fc6aecc46a2d74a2eb3830394ece82a77bed121c49ccbc6fb4fb7c05edbc90c17d591c2ee0f88bd3018893bc4cd0e003

Download Submit
C:\Program Files (x86)\GameGuard\cache\duhbmuv.cache

Filesize
15.3MB

MD5
1ac7965867072e615fea1ee20dc2300e

SHA1
d175990d7fe808931ee915470b130a2c37283ee8

SHA256
0cb8174d1aeb9bb9efa6cca18f09df5941e5f48d23240d207e15a25f20ac70fc

SHA512
4bdf16ff4c50d1e04dd4b9fa9cb3949c8a061bc7a2a5d86bc5cff07ad55ccafd5314a36189eb12e9164fc73b46830db5f54f553bb3d5112c0aee5dd22bb0dcf1

Download Submit
C:\Program Files (x86)\GameGuard\gameguard.exe

Filesize
7.2MB

MD5
81ed38976254bb646c0ecee753324027

SHA1
c3fe70f9daff9e66b315b2adc9481a7d39d7e7c6

SHA256
cf169e7a746c574f3e2ec653a6739ca71fe0e34aa76f604cd36706fe45536be7

SHA512
476a6f9f65857d015661dc8504c537efff00fbd69014ab2e36aeed393b69083962195b3aa6e4485aa46f7471aa59aec21a6e56a687fc6474cc7a62b9c47ca018

Download Submit
C:\Program Files (x86)\GameGuard\ggbfggpoox.exe

Filesize
16.9MB

MD5
d274658c7293070e421e9c441ab0e9b4

SHA1
103ac0fda11316ca57d6df6647eeebd02506f281

SHA256
8af22f3de2117b3a7681e2136b2a931bdb97c20e883a86554a40c8ae46bc361f

SHA512
8b55958e22088ea8f9d318a832f40ef154efc0805a9c32584fc7e625d2804e4b2dc0ef325d9d815e84b98730e096b921613dea1f08e8cf54032d500a69c6261d

Download Submit
C:\Program Files (x86)\GameGuard\steam_api.dll

Filesize
258KB

MD5
5be6351ea71a94ca4334f3211f5eb609

SHA1
1a5a83bebedcb499128219805296f042e5b9d159

SHA256
8d36de57cc6436f4e82ee672023f17a7f83a7a55af558582c2c139f83fb33ed0

SHA512
f61cab57849d12e9e0a26e73d20fda28085aff2e1a619501d25f9736ff455444a5d05d722ca32bb2356d5b209e29982ab93fd4e6b84acf4cb4b3ab5474d01655

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13b065f56671211fd2703992942b5f75

SHA1
7ac57856d6bf6f67c089c053e602a69e02b60830

SHA256
61575ca9427bbaa26c103749e2f27ff51c4640dbd34f246342598deae5e147c1

SHA512
34b86e7b4447323f8be0f097aa30d7b818baaacab672700b5ad6c64e11e8283d022cdd859adfe872f71db1f1c00774a53d34245633b91e3ae0504505b40088fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e808ae1b3533452c0e70394ddad38d3b

SHA1
999e64aa9afe828770b105fecf2bc755dc17cbc9

SHA256
baaf87808b8acfcbd9ca8af24a947469f19a8b0ac444962d6ea7c799006b4787

SHA512
b9ddddd457b003622c501086812055e0d05b525ff9900eccae07fd8996d50f833b4a0e97f9de929ce5c3d93fe7ffa22abc28d5d9ff55cd205beebb8ce058ddc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09d93e9b40cdd6d2ca695e42a24d8f2a

SHA1
f6755efa576eb886d2b28adc0d26a56bb1306992

SHA256
825a3e2eb291e12f71b28d38e58f9660a03b53cb603213fba07ef8756799a6bf

SHA512
e2efee35ceab8e7f3e1b441ac8822f1476fb4870b2ff1d9f2a86275acfefe812847fe32568166fadb75a99e7e3f583ba1e52d3c4a678313ebab749ac3a1f02d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcb080ecfd5978c2c258966484ff8bf3

SHA1
5e05cd6acd3687bf8b87dad05e628cf273de55f1

SHA256
5eac39eadd87147e1a0dfad8df0083e9040262f62e941b7c406de1fa9ded78cc

SHA512
b2ed6a57dca9523b42def7c664440309fc1c6c3ab66d20c3930ee3e9e3fc27baf502adda252511a2882e9f47d693a961d14c6b5156bd040bf1f5d14bad2fd073

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cc332fd490d04201dd9c35e7defa708

SHA1
d966785cefeb0d477de0c13cf36ef71212bd0ff9

SHA256
e55354e8162a2350580a77233383c33545123e7f8b1d042e9b920fa28276523b

SHA512
90ab1f1eee2aa5ee2fdc26a719855520f2fee4629e0e4a1ab6c19b7642b447c897754534b223a9d1fd58a1e41251cd2ec14815bd14b89c6330eb28c8abf57767

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3ef54655fd06309720b847a9895b5ee

SHA1
eb260d72f84715e1025a1b5ade24f5d2d7495aa0

SHA256
4c93eaa9b2fa93c8d7227483ae834f980622672333d8e5b82db7911f3238d15e

SHA512
d2079207fa6c78da9663bffff4f6b38f9208f76eb7a484fc6991befcb4e70e3732883a416585dae7506898ced5dbd958e810610da71a53439b6c25d76de51dc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10b5e3df3a1e2ad62ead32386148c93e

SHA1
35cfb60bf655fc72603155062de145550059773d

SHA256
7d4af23b4c6117e4ff0c04b46439af52d5a05502ac727780ff9a7307332896db

SHA512
7a9d1575e820abd8e97232aefd8a285763eef453abb67eb8909c13dfa18b4f5c8cde0cf3b3d6dd26d38fed717daa3c183a8f7215ea8fbcc3d09ec4138cb2c92d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5018465889a09c2c67f25d0ce90bd850

SHA1
2b77328938b8e6b0d50eac5598f5fec89ef83d12

SHA256
25c7ce38320185b4400c9f4df1a2b4425e5599062746b94119787e93eb762a72

SHA512
3bfa0798f5f25ead40d1283ff02354e08ce1299b719028fc9f302716bd202342c3f24a692ce77b14f99ded85650bd038de5ec71c0bab70ab1239fd4f3e7cd76f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d9f54300701643cd0bf6572d16b2947

SHA1
dcb6123febb7d6822c72b0c3d157c3d176d7d34f

SHA256
3577ba7ab69d29df37b67c6dfd9676bbd301506f4d7a9a658ff4e2682b0d85b7

SHA512
f136e0de4eee7b496e856c2a35cf930baba121988b6af2aa6cc7dd689d26196389084078c2c16904fe3d68fae98a7e9c1fe95601848564b9515efdb1ac2a9000

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70dbcae8940ecb98290c96c096a67a10

SHA1
1f9ab4903a6d1ee670b1e1dfb67ba9c05ff968c1

SHA256
0f28bd7a0f0d3512cae3682f504b0aafaf9a468755f213dd73589a249983f8bc

SHA512
32998c398507e3e4162b1fa650ac30420aefd06d5d429bee35e7c055983d2add67ab1bb70bb94b2a4cebb12effb3c1e10dbfd2027a42b2e9c45fd139ad84a7ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC850.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI64F5.tmp

Filesize
202KB

MD5
d773d9bd091e712df7560f576da53de8

SHA1
165cfbdce1811883360112441f7237b287cf0691

SHA256
e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7

SHA512
15a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC863.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\Installer\f772e60.msi

Filesize
7.7MB

MD5
68bd8f9af44479db013a77c806f1c674

SHA1
0cbb2b63c78b42e13b1818964bb2cf43e46c5052

SHA256
ac9ac5a95273064ba09af8be049124ba52db7a59075d69a94d12427917dbc376

SHA512
991f703293b984beeeda44cc72cacc0cd69bd4cb1856b2b1c5cf2a2d06d7f58e8469af70c2ecece05d98643937c52f8a944b9892e2925738457d2ac238867852

Download Submit
\Program Files (x86)\GameGuard\gguard.exe

Filesize
41.9MB

MD5
6b6d7a19c765cfb9021d6fbc3a4ff6ff

SHA1
c23923025df7d0b7bc947659b78de99a94c62c71

SHA256
b5ea882518b27ab7499d285f0516c1bbf435190d7d55b3835e787b6d62ec3894

SHA512
addc8ef031b2725f07667703e2d69c7cd167f3e50b5070a356fdcf7846514ec4610d47b350eb29d4df7aa75808bf03ff5186f3112f2063ab56988c4f199cb8b3

Download Submit
memory/2196-340-0x0000000001A60000-0x0000000001A61000-memory.dmp

Filesize
4KB

Download
memory/2196-343-0x0000000001A70000-0x0000000001A71000-memory.dmp

Filesize
4KB

Download
memory/2196-345-0x0000000001A70000-0x0000000001A71000-memory.dmp

Filesize
4KB

Download
memory/2196-338-0x0000000001A60000-0x0000000001A61000-memory.dmp

Filesize
4KB

Download
memory/2196-335-0x0000000001A50000-0x0000000001A51000-memory.dmp

Filesize
4KB

Download
memory/2196-328-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2196-333-0x0000000001A50000-0x0000000001A51000-memory.dmp

Filesize
4KB

Download
memory/2196-330-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2756-265-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2756-298-0x0000000001220000-0x0000000001DDE000-memory.dmp

Filesize
11.7MB

Download
memory/2756-297-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2756-295-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2756-293-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2756-292-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2756-290-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2756-288-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2756-287-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2756-285-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2756-282-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2756-280-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2756-277-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2756-275-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2756-272-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2756-270-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2756-267-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2756-263-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2756-262-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2756-258-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2756-260-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download