34a82344c0ddb5556bd9ca77637567bb964cb087bc941744187fef62dc597713

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05c82104f2fa8296ce86614d40df8fd2_JaffaCakes118.exe
Size

128KB
MD5

05c82104f2fa8296ce86614d40df8fd2
SHA1

66f3ae0733c2b16a2f3eff6ee81211efb2f8b21f
SHA256

34a82344c0ddb5556bd9ca77637567bb964cb087bc941744187fef62dc597713
SHA512

305ba925630edf6cee7091b492388e1f39ee2ca3b4a61e1f7148be2c1b39662b85b76b4132987e6fa4dd9e660453e693c80b0a7a07cf4cbf27c99c7ead653745
SSDEEP

1536:FLXB65939tY6HBg4sXJSiwhKKS20Ub2nLnVj1KxSmiwGOcVf2/dK24:FLk395hYXJSiZKoHLnux5i0VdK24

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

GLWorker.exeGLWorker.exeGLWorker.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	GLWorker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GLWorker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	GLWorker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GLWorker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	GLWorker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GLWorker.exe

Executes dropped EXE 13 IoCs

Processes:

GamesManagerInstaller.exeiWinUpgrader.exeugm_installer.exeGamesManager.exeawesomium_process.exeawesomium_process.exeiWinInstaller.exepreinstall-options.exe1733781543247264245.exeiWinInstallOptions.exeGLWorker.exeGLWorker.exeGLWorker.exe

pid	process
2624	GamesManagerInstaller.exe
2600	iWinUpgrader.exe
2420	ugm_installer.exe
2124	GamesManager.exe
2904	awesomium_process.exe
996	awesomium_process.exe
2228	iWinInstaller.exe
804	preinstall-options.exe
448	1733781543247264245.exe
2924	iWinInstallOptions.exe
1784	GLWorker.exe
2936	GLWorker.exe
2408	GLWorker.exe

Loads dropped DLL 64 IoCs

Processes:

05c82104f2fa8296ce86614d40df8fd2_JaffaCakes118.exeGamesManagerInstaller.exeugm_installer.exe

pid	process
2012	05c82104f2fa8296ce86614d40df8fd2_JaffaCakes118.exe
2012	05c82104f2fa8296ce86614d40df8fd2_JaffaCakes118.exe
2012	05c82104f2fa8296ce86614d40df8fd2_JaffaCakes118.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe
2420	ugm_installer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 7 IoCs

Processes:

GamesManagerInstaller.exe

description	ioc	process
File created	C:\Program Files (x86)\GMInstaller\ugm_installer.exe	GamesManagerInstaller.exe
File created	C:\Program Files (x86)\GMInstaller\iWinLauncher.exe	GamesManagerInstaller.exe
File created	C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe	GamesManagerInstaller.exe
File opened for modification	C:\Program Files (x86)\GMInstaller\iWinLauncher.exe	GamesManagerInstaller.exe
File opened for modification	C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe	GamesManagerInstaller.exe
File opened for modification	C:\Program Files (x86)\GMInstaller\ugm_installer.exe	GamesManagerInstaller.exe
File opened for modification	C:\Program Files (x86)\GMInstaller\	GamesManagerInstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\GamesManager\00000000\downloads\1733781543247264245.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\GamesManager\00000000\downloads\1733781543247264245.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe	nsis_installer_2

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

GamesManager.exeawesomium_process.exeawesomium_process.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GamesManager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GamesManager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	awesomium_process.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	awesomium_process.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	awesomium_process.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	awesomium_process.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

iWinInstaller.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\iWinArcade	iWinInstaller.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\iWinArcade\installRoot = "c:\\games\\iWin Games"	iWinInstaller.exe

Modifies registry class 44 IoCs

Processes:

GLWorker.exeGLWorker.exeiWinInstaller.exeGLWorker.exeGamesManager.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}	GLWorker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\VersionIndependentProgID\ = "MapiCvt.MapiCvt"	GLWorker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\zeaqkancIgqPf = "J`upAgKCeMol"	GLWorker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\iWinArcade\1733781543247264245 = "Jewel Quest II"	iWinInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\ = "MapiCvt Class"	GLWorker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\InprocServer32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\MIMEDIR.DLL"	GLWorker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\zeaqkancIgqPf = "G`upAgDX_XHH"	GLWorker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\tqizfxlmky = "WMQgYm^OGCoATm`jhL"	GLWorker.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\VirtualStore\MACHINE\SOFTWARE\Wow6432Node	GamesManager.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\zeaqkancIgqPf = "F`upAgKJTgYL"	GLWorker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\gwyW = "xBWIG[LN~KDQrshCLvnTw}xXL`{A"	GLWorker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\wtrReKXs = "QZ]O{khtOnapmlvChG}^DkKd\\"	GLWorker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\iWinArcade\Jewel Quest II\GameExe = "GameLauncher.exe"	iWinInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\iWinArcade\Jewel Quest II\GameName = "Jewel Quest II"	iWinInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\iWinArcade\Jewel Quest II\GameID = "1733781543247264245"	iWinInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\syxetg = "qz@g\x7fOumsLdhtkLyT{LudeQ"	GLWorker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\pqbRdhGsme = "HMOsG}_ZlC\|NiRLhA\x7fLQxY"	GLWorker.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\iWinArcade	GamesManager.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\InprocServer32\ThreadingModel = "Both"	GLWorker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\ProgID	GLWorker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\VersionIndependentProgID	GLWorker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\kbfqMcaiilzvt = "OWmOOmNiY~Z\x7fDBLy]{of]n{ixyTd"	GLWorker.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\VirtualStore\MACHINE	GamesManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\iWinArcade\Jewel Quest II\InstallDir = "c:\\games\\iWin Games\\Jewel Quest II"	iWinInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\InprocServer32	GLWorker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\gwyW = "xBWIG[LN~KDQrshCLvnTw}xXL`{A"	GLWorker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\dEyyhcQm = "LMi@XHjx\\BhaRfdDewCntRw"	GLWorker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\kbfqMcaiilzvt = "OWmOOmNiYNZ\x7fDBLy]Kof]n{ixyTd"	GLWorker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\kbfqMcaiilzvt = "OWmOOmNiY~Z\x7fDBLy]{of]n{ixyTd"	GLWorker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\zeaqkancIgqPf = "D`upAgMKGW^d"	GLWorker.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\VirtualStore	GamesManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\iWinArcade\Jewel Quest II\SkuID = "6899126784130858863"	iWinInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\ProgID\ = "MapiCvt.MapiCvt.1"	GLWorker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\syxetg = "qz@g\x7fOumsLdhtkLyT{LudeQ"	GLWorker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\zeaqkancIgqPf = "K`upAg@CLUlX"	GLWorker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\dEyyhcQm = "LMi@XHjx\\BhaRfdDewCntRw"	GLWorker.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\VirtualStore\MACHINE\SOFTWARE\iWinArcade	GamesManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\VirtualStore\MACHINE\SOFTWARE	GamesManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\iWinArcade\Jewel Quest II	iWinInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\tqizfxlmky = "WMQgYm^OGCoATm`jhL"	GLWorker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\pqbRdhGsme = "HMOsG}_ZlC\|NiRLhA\x7fLQxY"	GLWorker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\wtrReKXs = "QZ]O{khtOnapmlvChG}^DkKd\\"	GLWorker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\zeaqkancIgqPf = "E`upAgFKnO]P"	GLWorker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45C060F4-0B94-5708-1587-B30FE652A558}\kbfqMcaiilzvt = "OWmOOmNiYnZ\x7fDBLy]kof]n{ixyTd"	GLWorker.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

Processes:

GamesManagerInstaller.exeiWinUpgrader.exeGamesManager.exeiWinInstaller.exe

pid	process
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2600	iWinUpgrader.exe
2600	iWinUpgrader.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2124	GamesManager.exe
2624	GamesManagerInstaller.exe
2624	GamesManagerInstaller.exe
2228	iWinInstaller.exe
2228	iWinInstaller.exe
2228	iWinInstaller.exe
2228	iWinInstaller.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

GLWorker.exeGLWorker.exeGLWorker.exe

description	pid	process
Token: 33	1784	GLWorker.exe
Token: SeIncBasePriorityPrivilege	1784	GLWorker.exe
Token: 33	2936	GLWorker.exe
Token: SeIncBasePriorityPrivilege	2936	GLWorker.exe
Token: 33	2408	GLWorker.exe
Token: SeIncBasePriorityPrivilege	2408	GLWorker.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

GamesManager.exe

pid process

2124 GamesManager.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

GamesManager.exe

pid process

2124 GamesManager.exe

pid	process
2124	GamesManager.exe

pid	process
2124	GamesManager.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

05c82104f2fa8296ce86614d40df8fd2_JaffaCakes118.exeGamesManagerInstaller.exeugm_installer.exeGamesManager.exeiWinInstaller.exe1733781543247264245.exe

description	pid	process	target process
PID 2012 wrote to memory of 2624	2012	05c82104f2fa8296ce86614d40df8fd2_JaffaCakes118.exe	GamesManagerInstaller.exe
PID 2012 wrote to memory of 2624	2012	05c82104f2fa8296ce86614d40df8fd2_JaffaCakes118.exe	GamesManagerInstaller.exe
PID 2012 wrote to memory of 2624	2012	05c82104f2fa8296ce86614d40df8fd2_JaffaCakes118.exe	GamesManagerInstaller.exe
PID 2012 wrote to memory of 2624	2012	05c82104f2fa8296ce86614d40df8fd2_JaffaCakes118.exe	GamesManagerInstaller.exe
PID 2012 wrote to memory of 2624	2012	05c82104f2fa8296ce86614d40df8fd2_JaffaCakes118.exe	GamesManagerInstaller.exe
PID 2012 wrote to memory of 2624	2012	05c82104f2fa8296ce86614d40df8fd2_JaffaCakes118.exe	GamesManagerInstaller.exe
PID 2012 wrote to memory of 2624	2012	05c82104f2fa8296ce86614d40df8fd2_JaffaCakes118.exe	GamesManagerInstaller.exe
PID 2624 wrote to memory of 2600	2624	GamesManagerInstaller.exe	iWinUpgrader.exe
PID 2624 wrote to memory of 2600	2624	GamesManagerInstaller.exe	iWinUpgrader.exe
PID 2624 wrote to memory of 2600	2624	GamesManagerInstaller.exe	iWinUpgrader.exe
PID 2624 wrote to memory of 2600	2624	GamesManagerInstaller.exe	iWinUpgrader.exe
PID 2420 wrote to memory of 2124	2420	ugm_installer.exe	GamesManager.exe
PID 2420 wrote to memory of 2124	2420	ugm_installer.exe	GamesManager.exe
PID 2420 wrote to memory of 2124	2420	ugm_installer.exe	GamesManager.exe
PID 2420 wrote to memory of 2124	2420	ugm_installer.exe	GamesManager.exe
PID 2124 wrote to memory of 2904	2124	GamesManager.exe	awesomium_process.exe
PID 2124 wrote to memory of 2904	2124	GamesManager.exe	awesomium_process.exe
PID 2124 wrote to memory of 2904	2124	GamesManager.exe	awesomium_process.exe
PID 2124 wrote to memory of 2904	2124	GamesManager.exe	awesomium_process.exe
PID 2124 wrote to memory of 996	2124	GamesManager.exe	awesomium_process.exe
PID 2124 wrote to memory of 996	2124	GamesManager.exe	awesomium_process.exe
PID 2124 wrote to memory of 996	2124	GamesManager.exe	awesomium_process.exe
PID 2124 wrote to memory of 996	2124	GamesManager.exe	awesomium_process.exe
PID 2124 wrote to memory of 2228	2124	GamesManager.exe	iWinInstaller.exe
PID 2124 wrote to memory of 2228	2124	GamesManager.exe	iWinInstaller.exe
PID 2124 wrote to memory of 2228	2124	GamesManager.exe	iWinInstaller.exe
PID 2124 wrote to memory of 2228	2124	GamesManager.exe	iWinInstaller.exe
PID 2124 wrote to memory of 2228	2124	GamesManager.exe	iWinInstaller.exe
PID 2124 wrote to memory of 2228	2124	GamesManager.exe	iWinInstaller.exe
PID 2124 wrote to memory of 2228	2124	GamesManager.exe	iWinInstaller.exe
PID 2228 wrote to memory of 804	2228	iWinInstaller.exe	preinstall-options.exe
PID 2228 wrote to memory of 804	2228	iWinInstaller.exe	preinstall-options.exe
PID 2228 wrote to memory of 804	2228	iWinInstaller.exe	preinstall-options.exe
PID 2228 wrote to memory of 804	2228	iWinInstaller.exe	preinstall-options.exe
PID 2228 wrote to memory of 804	2228	iWinInstaller.exe	preinstall-options.exe
PID 2228 wrote to memory of 804	2228	iWinInstaller.exe	preinstall-options.exe
PID 2228 wrote to memory of 804	2228	iWinInstaller.exe	preinstall-options.exe
PID 2228 wrote to memory of 448	2228	iWinInstaller.exe	1733781543247264245.exe
PID 2228 wrote to memory of 448	2228	iWinInstaller.exe	1733781543247264245.exe
PID 2228 wrote to memory of 448	2228	iWinInstaller.exe	1733781543247264245.exe
PID 2228 wrote to memory of 448	2228	iWinInstaller.exe	1733781543247264245.exe
PID 448 wrote to memory of 2924	448	1733781543247264245.exe	iWinInstallOptions.exe
PID 448 wrote to memory of 2924	448	1733781543247264245.exe	iWinInstallOptions.exe
PID 448 wrote to memory of 2924	448	1733781543247264245.exe	iWinInstallOptions.exe
PID 448 wrote to memory of 2924	448	1733781543247264245.exe	iWinInstallOptions.exe
PID 448 wrote to memory of 2924	448	1733781543247264245.exe	iWinInstallOptions.exe
PID 448 wrote to memory of 2924	448	1733781543247264245.exe	iWinInstallOptions.exe
PID 448 wrote to memory of 2924	448	1733781543247264245.exe	iWinInstallOptions.exe
PID 2124 wrote to memory of 1784	2124	GamesManager.exe	GLWorker.exe
PID 2124 wrote to memory of 1784	2124	GamesManager.exe	GLWorker.exe
PID 2124 wrote to memory of 1784	2124	GamesManager.exe	GLWorker.exe
PID 2124 wrote to memory of 1784	2124	GamesManager.exe	GLWorker.exe
PID 2124 wrote to memory of 2936	2124	GamesManager.exe	GLWorker.exe
PID 2124 wrote to memory of 2936	2124	GamesManager.exe	GLWorker.exe
PID 2124 wrote to memory of 2936	2124	GamesManager.exe	GLWorker.exe
PID 2124 wrote to memory of 2936	2124	GamesManager.exe	GLWorker.exe
PID 2124 wrote to memory of 2408	2124	GamesManager.exe	GLWorker.exe
PID 2124 wrote to memory of 2408	2124	GamesManager.exe	GLWorker.exe
PID 2124 wrote to memory of 2408	2124	GamesManager.exe	GLWorker.exe
PID 2124 wrote to memory of 2408	2124	GamesManager.exe	GLWorker.exe

C:\Users\Admin\AppData\Local\Temp\05c82104f2fa8296ce86614d40df8fd2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05c82104f2fa8296ce86614d40df8fd2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2012

C:\Users\Admin\AppData\Local\Temp\nsiEB1.tmp\GamesManagerInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\nsiEB1.tmp\GamesManagerInstaller.exe" -installer.createiwinshortcuts=yes -config.channel=00000000 -config.uri=http://gm/iwin/index.html -config.channelName=iWin -config.iwinrequest=PF/1733781543247264245/6899126784130858863/13/0
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2624

C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe
"C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe" -gmregchannelid=00000000
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2600

C:\Program Files (x86)\GMInstaller\ugm_installer.exe
"C:\Program Files (x86)\GMInstaller\ugm_installer.exe" -installer.createiwinshortcuts=yes -config.channel=00000000 -config.uri=http://gm/iwin/index.html -config.channelName=iWin -config.iwinrequest=PF/1733781543247264245/6899126784130858863/13/0
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420

C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe
"C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe" -config.uri=http://gm/iwin/index.html -config.channel="00000000" -config.iwinrequest="PF/1733781543247264245/6899126784130858863/13/0"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2124

C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe
"C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe" --type=renderer --enable-logging --log-level=2 --no-sandbox --user-agent="NextDM/2.16.2.1015 AppleWebKit/535.19 (KHTML, like Gecko) GamesManager/2.16.2.1015 00000000 WinVer/6.1 [x64]" --awesomium-log-path="C:\Users\Admin\AppData\Local\GamesManager\./awesomium.log" --lang --channel=2124.02C01C80.536718711 /prefetch:3
3⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2904

C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe
"C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe" --type=gpu-process --channel=2124.02C96DC0.184991180 --enable-logging --log-level=2 --no-sandbox --awesomium-log-path="C:\Users\Admin\AppData\Local\GamesManager\./awesomium.log" /prefetch:12
3⤵
- Executes dropped EXE
- Checks processor information in registry
PID:996

C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe
"C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe" -gmregcopysrc="HKEY_LOCAL_MACHINE\Software\iWinArcade" -gmregcopydest="HKEY_CURRENT_USER\Software\iWinArcade" -gmregcopylocalmachinedest="HKEY_LOCAL_MACHINE\Software\iWinArcade" -gmregisiwin=true -gmchannelcode=00000000 -game.sku="1733781543247264245" -game.name="Jewel Quest II" -gmregcopyvirtual=HKU\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\iWinArcade -gmreg="Software\iWinArcade" -gmexe="iWinGames.exe" -gmregkey="Install_Dir" -installer="C:\Users\Admin\AppData\Local\GamesManager\00000000\downloads\1733781543247264245.exe" -preinstallurl="http://gm.iwin.com/dl/preinstall-options.exe" -gamestring=1733781543247264245 -config.installRoot="c:\games\iWin Games" -gmInstallRootRegKey="HKEY_CURRENT_USER\Software\iWinArcade\installRoot"
3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2228

C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe
"C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe" -gamestring=1733781543247264245 /S
4⤵
- Executes dropped EXE
PID:804

C:\Users\Admin\AppData\Local\GamesManager\00000000\downloads\1733781543247264245.exe
"C:\Users\Admin\AppData\Local\GamesManager\00000000\downloads\1733781543247264245.exe" /S
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448

C:\Users\Admin\AppData\Local\Temp\nsjB55C.tmp\iWinInstallOptions.exe
"C:\Users\Admin\AppData\Local\Temp\nsjB55C.tmp\iWinInstallOptions.exe" /S
5⤵
- Executes dropped EXE
PID:2924

\??\c:\games\iWin Games\Jewel Quest II\GLWorker.exe
"c:\games\iWin Games\Jewel Quest II\GLWorker.exe" ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid1733781543247264245
3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1784

\??\c:\games\iWin Games\Jewel Quest II\GLWorker.exe
"c:\games\iWin Games\Jewel Quest II\GLWorker.exe" ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid1733781543247264245
3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2936

\??\c:\games\iWin Games\Jewel Quest II\GLWorker.exe
"c:\games\iWin Games\Jewel Quest II\GLWorker.exe" ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid1733781543247264245
3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2408

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GMInstaller\ugm_installer.exe
Filesize
56.4MB

MD5
8279606392484837456a9155a6725bb4

SHA1
98e896d76658036c0d692c24e73d62a3a17471a0

SHA256
e87e8b7aae5c305ff870862d7b68e4c7727cfd6c60a83b9cf9c856c2a14a3eac

SHA512
8db2232a04c681a8315e79cceb85165286564004b4c43aa98c47066bcc73786c9eabbc21bb540d8837d22a67b3af98a87813be324b508c1fa1bd0fae6dcefede

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\downloads\1733781543247264245.exe
Filesize
28.2MB

MD5
03a8cea6bdb1a762dd969f139e264b99

SHA1
77f0cb6c5740dd2936f5338deece8a710f373a29

SHA256
f3a4d18ed1b4f19b87582e972d59ddd97e588baf6038b03528562dd621b861d5

SHA512
ddcb5b7ee299d45c6a3992f34c6953452bdff64f75a0eb69dcc74331f854da7e6109e8a84562b8a277e583f2df3e9c72e12142f800e12db36cd4cb16d72339b7

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\webdata\AppCache\Cache\f_000001
Filesize
248KB

MD5
e2ff9e87912d08576c7f26a8014b2525

SHA1
026136afd27657e7edead2f12310275af249caac

SHA256
5e663896f40416a2d5f159e0433dbc9019dbe9d05abb34c1f3a5b38a88b5c03a

SHA512
7b4dfe37205909f2f14669c965821a91daba8be383ce83d119fde5d290bc938eeaf0c70e9d27998f00dc6cdca0d0c0b1b2bbdc13ac2662fc4e766919e092e1d9

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\webdata\AppCache\Cache\f_000002
Filesize
36KB

MD5
ae0a675e3e15e28aab8246028df16236

SHA1
772b2587aa2fa345fb760eff9ebe5acd97937243

SHA256
49f14bad610f40f0ae76a33c55ef89a1e694219bab49b1b99cb53d754774c0fc

SHA512
21723efa6aaa2fa599b42c1480c380c24f9aaf14755e82e88054e80713454408bfb047ba77d921d71573d2319f14f134938f3401aa3b92b756670b7c99892caa

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\webdata\AppCache\Cache\f_000003
Filesize
51KB

MD5
a959af924d21c7b788fe197caf03fc40

SHA1
21733827a5501133619b8ac4533201267d1afa3f

SHA256
4d191ea72953f5806161c3c16ae8e4bb629b47156481bd074acfa5db08000016

SHA512
1fa28a7fe716b328fc43b3e8993875977a2e9f39fd02dfce313d27021403ddfaf7f19c7607bf1350c4c2f05a38170d3621ed33cc60f8b38fb9d1dbda63b120e7

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\webdata\AppCache\Cache\f_000004
Filesize
242KB

MD5
7fd8ffea25728006bfddf7e6c7c122cd

SHA1
e3049e9f8a643b8b2cfd2ca5e6ab8bfd483efe99

SHA256
0a6c4c4db171663b9b1c533a4dd6938e22cb4d5b9607d0ca92a20c1354018b49

SHA512
477467568f8c24772fd83680db1e9750c7e377cb706c0fa734e9c8b1bc847cf9a60f4be444044bdbfa4cdb9cb4352f86edd1ea70bdcd86a20b361f9acb2cd58f

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\webdata\AppCache\Cache\f_000005
Filesize
58KB

MD5
8c81fab58b8ed37b527b16a37a8065c3

SHA1
5d3d58f8833d9975d6dd5e7153b22a936f2f76bd

SHA256
74d4acb9d62968980f8a096977e3bf42c1ccffb0c7501a7fff1a0ba589b56bd7

SHA512
e99c9eae7718c4154bc2895431261e1ac3cafda565d85474876be004063742d84af1c20f970dd1f30c9c5acbb00d3e7357f7a13376730cbd987a24dcc4086699

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\webdata\AppCache\Cache\f_000006
Filesize
16KB

MD5
032f7a630c11189923cae95fb0fa6892

SHA1
74dddaa937b077fb98b584b20e1a3e3ad1bee422

SHA256
b0b84f6aca649b3b9131799ed0983e03b113497df4f33e30a3389ee1b34687ee

SHA512
e24c5a9dfd1f6fcd07dea0b3723a0794fe27042c2f52d0b869e8224ed0a442e73e24d265103ba2f11783b8c408f9724ba11ef76a1e3330ee3b78156ebad406bf

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\webdata\AppCache\Cache\f_000007
Filesize
63KB

MD5
962bf963a37a6d84fe7fb552763dc094

SHA1
cac681467dac917122dd9b57bd9a78781549a523

SHA256
2f49797d196f00bb331663ac1564c775d65ed1bfb508aec9e4c3b6fc89bb4dc0

SHA512
e378da6a0d29f91eb5a0de3876fda0cc1b5a6e6632f5ddf0d45fcc909084aad70bd99b97a29df15d271593701bd77a92766a1f091540dc3cdf699c9d831b6192

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\webdata\AppCache\Cache\f_000008
Filesize
21KB

MD5
5cc4154e0c0dac8dfeea73c07ccdc83e

SHA1
5d2d995d51b8855d1e1e43b85d8b5a9d22b796ad

SHA256
12d5f1be9a764164f4cc6e7dda726c4ea3d19ea79382d28c75b0dea862608968

SHA512
1112959cfecc25efae799b566dff24f7bfafc60ddd8974ce0cdd653ee834a57090d9f78e2773ad9a826e0ba6e1487c49e1ef957c34385c262914f09ea8b26157

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\webdata\AppCache\Cache\f_000009
Filesize
48KB

MD5
b41c0b75a60eab42145e9d0b17408b0b

SHA1
0f3151c6c22834079b55fcea9d873c0184b3fd7c

SHA256
209dc679252feca2725cafb6e8fc314f2618bd748db846be6b4e0ca71c55a330

SHA512
f728be6cb869a6279a6ba1d85865c510c6f9905a04226a25965b7b5eb0feadbaf4364f4508b08292eb597b2a9fe14af4e6fa8a9eb56f4e704108dc09e862edbe

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\webdata\AppCache\Cache\f_00000a
Filesize
39KB

MD5
4e5d5ff08a7703b746695ec19bf96b88

SHA1
3496f9b943d53c957ed8481e3e2cd1ecc0decb4e

SHA256
3e05db9eae5443e2b629ae73496a7872602094fcf63d11eb5d99e63911c89d1e

SHA512
cabe3907ea165502d90b847642cbc4be99108b6eb18ad251f2acfe988131b2ed12fab8516e374c5e2a19b10c9df9c9ed3252cbffb7cd0c0fb9dcd258e2f4bb31

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\webdata\AppCache\Cache\f_00000b
Filesize
151KB

MD5
0128fb0696c3dd27adc2286988bf9042

SHA1
343db277048078eb9a12b76b8f482aae5d9e7ac2

SHA256
13bf19f7b084c49a6ef22dee10328411f4764e765209956bc1d01c8120cdacdb

SHA512
173b2bd5cdf252380286622fcb9ebd72c361788fcd00a04274dc330f7d20cc152cc29506bd5d03768518bab23053ec98c0ae522fe600987a479a15279d72acbd

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\webdata\AppCache\Cache\f_00000c
Filesize
66KB

MD5
201f988a9071a4a4a3d188bdecda38f5

SHA1
4ad903f73ee31f12b1c9e4c820439273cbc92727

SHA256
53c53364808c175a6038f9d0aae8fe3d1f5ce3cf87d5e9fa08f603d845633b37

SHA512
d9af07915a589ee48b08a1b8880d88d6215438292f4a227cbc809086c2dbd5735713c0929758359a8f3391dae746cd9b9de7885d5af560698a21be7d9f5bc025

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\webdata\AppCache\Cache\f_00000d
Filesize
77KB

MD5
516a9c398435f4e0e519d13091892fca

SHA1
c1a8a3747fed87cf8699c18b6f80f5369e207908

SHA256
de5c4e5ba7b850bbe5d35de5b20f4fd875be1f77ef73f7431172d1e0f6496dc6

SHA512
b79eab3e4abc5bd164d27f282a9913ad0c82bdbcb028be5137b77a429e6384e715d05a90014c23298152d2fe3ad2f90309ca028727ed9750cf29fd55b6d75302

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\webdata\AppCache\Cache\f_00000e
Filesize
39KB

MD5
4d0d60167bc23a412bcd8880d59e13d8

SHA1
cfbf2a6ed97ed0a30c571d2bbd6eb60731eaea27

SHA256
cd299b9251186ebf3bb0e928e4f710b3b542f0cde01bea6832cbada49138a85d

SHA512
6d56d41161bbe491a8f847ae3782e283a61d40d499d91fa6ef82ea845b347b8337b84e69024828dcbbf884b167afca67bdd67c7593a1a90950bab6fbdbb8eeba

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\webdata\AppCache\Cache\f_00000f
Filesize
46KB

MD5
b6438c9bc90d3e87381b574cdf17ae97

SHA1
86051ff3f018c1a475162597dab27079eef2ec7a

SHA256
a6db907a7ac399d7e920de4ac4b4a92808542039ba32dc6758637bffb413d56d

SHA512
c4d56c8880d5c27085cf64531d2620f84c950107fdda28986eb0bb4d2ce1b4a90f0d890b72f60b48ef2637b3dab7fd99ccf1f507c949ce5f66b52f756c3c6fe6

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\webdata\AppCache\Cache\f_000010
Filesize
246KB

MD5
af693f9aea7dae36fb3bef4c9b6e56fb

SHA1
0d7896e2bb23f88e26e52b22a075350b354df447

SHA256
1717ea1fde8ceb7584341a24efc85c853083c660a1185968fbf94520f7193de2

SHA512
11cad7c40e29808104a9b84cfe2f4f1aa80f4ad06a07fd1379c64818fe869c6b6036af36f4dd3304e19b612141e9cf7b04e11c7a38a721ad03c067d9c07b266a

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\webdata\AppCache\Cache\f_000011
Filesize
25KB

MD5
3c4b51f57a2ff4369261b845d84ca1ea

SHA1
3bb9a2f72d5fa0a9c4140ab74212d4cdd25fa323

SHA256
379bc709031d0e429a41012efd921210bcfd409ecaabe35257a3716032eb99a3

SHA512
81d0120f63e30cc5b31fc98af2caf75cd836defedf08a1918b019a4bd7fdc9746340ef81f7ead84299d6eceb3812a6edc79481344dd7ef19d7af572b1f2bac3d

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\webdata\AppCache\Cache\f_000012
Filesize
82KB

MD5
5ce0a99458a2c7f2c0a6f3eb1a03d1d5

SHA1
6b3fdc4185f603a0948d2e8b7bc818763d7e2668

SHA256
6c5c0a29044c5aeec37211b18908acd0576b9dabc9d6fe95c8066cdc55146c0f

SHA512
5939d60a40f729b7ea19d6c9c1d264d7a174c6436748ea8c9619e7a20c1f1d4889f7e9b4cd017a889c985e9d2fd272e01d3e03d6b97325b2e8de5f3f9e1f2d67

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\webdata\AppCache\Cache\f_000013
Filesize
581KB

MD5
107a4b9f1d95df5b969cced5c7248ded

SHA1
9341318acb76e81987277b335656f6d265066691

SHA256
295eac26825508b5f37f27c69b99d426582fe80752f636c69f1795be8f5d5ea4

SHA512
36c22b62a0377831b37ecc4f34b6912842bc57c2f9351548d1ba120ca2c9abaca709cd40046abc06d4b77694cbf1977b8f5d7ce899653f130ac697402e127857

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\webdata\AppCache\Cache\f_000014
Filesize
160KB

MD5
7776d481997157e93d96f8589c3ae050

SHA1
13007e647ea91299b5aaaf7fc03a30bb65c38cd0

SHA256
74cd4d1f792e1200fd426048b53970c4eaeb5e5c1c789d034bffdff68167b3be

SHA512
12401e53282bcb20f6287f73b0d51c1c018cb0013df2d03e7d719eaa9e7fe952b9252c22445b67acdd78696f7b464045aed14f6e795922680fe733a0084a6217

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\webdata\AppCache\Cache\f_000015
Filesize
238KB

MD5
112aef1f1740c497873762c576ba91ec

SHA1
63de6bd3e38f536213dddddb20c5cb61c232078f

SHA256
7f6a44eb7632c2cb6f990ede10a58c2cc3fb923bae1761f1be8e2a9ea3847b78

SHA512
9b3f9e5b4f911e0fc8404e89a68e308b14b4d2470d8358f95991d04abbc5ee04e3d93255deba720d3589f278938cf92710cc4f38f6b26c778d82d4680da89fbb

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\webdata\AppCache\Cache\f_000016
Filesize
620KB

MD5
5a52b3c4658c45fa0d16f1b245cba28d

SHA1
1066afce3c4ca00ca7f61c628f6ba4a615b50c4f

SHA256
f148af9bffe215b1396117bb04aeb9f35fc82f346999a767a363198e9878ceae

SHA512
08ed56e8ef57a87bc84cc82355fbb9b5742a3a3218c5bf27369d2fc7d71d5c740af8c8830a85af3544ae5f2e96f59c9a0267a512a5c009c3e03683a3ef5f85bd

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\00000000\webdata\Cache\index
Filesize
512KB

MD5
9bf575bcc94beb8f3da34101cdecf7ea

SHA1
57282ec670d6036033371d1e360b52a8bea2c7dc

SHA256
44b2f3ac069879c64561f4ae8cd526a8771dc4dc89083206ba92d52d8527ca37

SHA512
9036391a45aba9dd3c3e4ba02eda193b26923e7406c9916ea1a72c307c7f515bde45d4bddc8e3c37a6978c1753e0c0481da0a4e0806106a626b98927dad37296

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\110402287\cdata.dat
Filesize
379KB

MD5
11e4b4414b6271b8f8c45511f97d4e5a

SHA1
65ee25560144d22bf7f8bce3b8742a856a8ee6d1

SHA256
db67ca3cf89a6fccd13aa21207e279c3fd3c7bcaf181c65ecfc18cf2da289eb3

SHA512
68e8bce33cfc588f800f486f51c8a1e27b12e58af336946102d61a451341eee875b4cbb2a4203f3cade174b21f9e74cd82d15988abb107564c87c2e3bd088c58

Download Submit
C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe
Filesize
4.0MB

MD5
e6fd8ebffb607e1ade009aec7d657fd4

SHA1
9df29bd83f62fcb7c6f3f644692254a698e54f28

SHA256
86007bfeee566f599f1eb496710835ca2975bd710067cc6a095f909828a5580a

SHA512
3d65334200bfbf2eece9e8b98894cd78d3d58c76a45e1d864cc9648c96c57633671a87646e6268c4a14ee846ed2eec4706041e61a80e2657a1d05a7afb6a88e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi2981.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyB51D.tmp\System.dll
Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe
Filesize
84KB

MD5
a20e6e80fca5126c64c469d8882c8b03

SHA1
9037bde28752b5bc54b2e0a76c753e94981c362f

SHA256
bd97b982be79ace9c3ca0ec4fa7572d9005eaa164426d9cb81f63e17f88d31c2

SHA512
f1d82d31ef70206bb178fdd17f4bbcd635ef74da11b5989c771a3fb9aed8603a0dc4768945780a19619c482661ae09c11b8e74b837a43cd98ccde6440e0d8e4f

Download Submit
\Program Files (x86)\GMInstaller\iWinUpgrader.exe
Filesize
1.5MB

MD5
3d72f38357f46715e675e074d59fc7a9

SHA1
2cf2f0d655fbbff941ae3d5c1e911096fec5bd12

SHA256
86cb79cb393ccbebd65e137cf509f09e0cabaecb93a2d21369488002712af118

SHA512
35f5e1f19490814db7bb041588ed9f6c99a04cdb485c19fbae3e96e59da003c345aa835fe482e904c73577f37eba6f47982dc4ba5d3b5a58396b794830639006

Download Submit
\Users\Admin\AppData\Local\Temp\nsi2981.tmp\StdUtils.dll
Filesize
26KB

MD5
c291f96471927e7bc49398b0de7168dd

SHA1
eda478005d69ee86126a8378de5007b139e20a5d

SHA256
c169393e49723cfdcdcbcf80e062be9e841539f90e4b7b85b482212715a1f7c6

SHA512
b4244615e99617d437d3120f201ca88c7ab4a6b4b84e7f0c3b4495a0fe8c979e04feaa08f11ad14fa92f002a3a521422221132ff54a081ef1c6bcbdf09d5929d

Download Submit
\Users\Admin\AppData\Local\Temp\nsiEB1.tmp\GamesManagerInstaller.exe
Filesize
57.3MB

MD5
a0b9f336e863dafb3b5670f6c30f120d

SHA1
1e7c7ae090f6e1f8100ae06e7c1f23d4c1332ed2

SHA256
0a4dfeae0404ac24808f9ae41bfc41a7223dda04c110179a679a5e3005018ed1

SHA512
baf6b8fd16900714f2950befcba40cfd4048ece132ebad57e430e2752527ce0e2cc78d3d255bdb4eb3d9cd06aee1cf010a35ec0cd28df3a5b61cd37591fb1421

Download Submit
\Users\Admin\AppData\Local\Temp\nsiEB1.tmp\NSISdl.dll
Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsiEB1.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nso4CFA.tmp\System.dll
Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
memory/448-2048-0x0000000003420000-0x00000000036F0000-memory.dmp

Filesize
2.8MB

Download
memory/448-2047-0x0000000003420000-0x00000000036F0000-memory.dmp

Filesize
2.8MB

Download
memory/1784-2072-0x0000000001F50000-0x000000000209D000-memory.dmp

Filesize
1.3MB

Download
memory/1784-2074-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/1784-2066-0x0000000001F50000-0x000000000209D000-memory.dmp

Filesize
1.3MB

Download
memory/1784-2075-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/1784-2076-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/1784-2079-0x0000000001F50000-0x000000000209D000-memory.dmp

Filesize
1.3MB

Download
memory/1784-2081-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/1784-2077-0x0000000001F50000-0x000000000209D000-memory.dmp

Filesize
1.3MB

Download
memory/2124-919-0x0000000000130000-0x0000000000142000-memory.dmp

Filesize
72KB

Download
memory/2124-2103-0x000000000DA60000-0x000000000DC0C000-memory.dmp

Filesize
1.7MB

Download
memory/2124-2065-0x000000000DA60000-0x000000000DC0C000-memory.dmp

Filesize
1.7MB

Download
memory/2124-2064-0x000000000DA60000-0x000000000DC0C000-memory.dmp

Filesize
1.7MB

Download
memory/2124-2137-0x000000000DA60000-0x000000000DC0C000-memory.dmp

Filesize
1.7MB

Download
memory/2124-2138-0x000000000DA60000-0x000000000DC0C000-memory.dmp

Filesize
1.7MB

Download
memory/2124-2139-0x000000000DA60000-0x000000000DC0C000-memory.dmp

Filesize
1.7MB

Download
memory/2124-2140-0x000000000DA60000-0x000000000DC0C000-memory.dmp

Filesize
1.7MB

Download
memory/2408-2111-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/2408-2123-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/2624-45-0x0000000002B50000-0x0000000002B52000-memory.dmp

Filesize
8KB

Download
memory/2904-1103-0x0000000074E70000-0x0000000074EA3000-memory.dmp

Filesize
204KB

Download
memory/2904-1198-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1094-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1093-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1092-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1091-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1089-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1087-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1085-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1084-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1082-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1081-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1079-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1078-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1076-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1075-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1074-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1072-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1097-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1123-0x0000000074E70000-0x0000000074EA3000-memory.dmp

Filesize
204KB

Download
memory/2904-1122-0x0000000074F30000-0x0000000074F57000-memory.dmp

Filesize
156KB

Download
memory/2904-1121-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1124-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2904-1200-0x0000000074E70000-0x0000000074EA3000-memory.dmp

Filesize
204KB

Download
memory/2904-1199-0x0000000074F30000-0x0000000074F57000-memory.dmp

Filesize
156KB

Download
memory/2904-1095-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1099-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1100-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1101-0x0000000074E70000-0x0000000074EA3000-memory.dmp

Filesize
204KB

Download
memory/2904-1102-0x0000000074E70000-0x0000000074EA3000-memory.dmp

Filesize
204KB

Download
memory/2904-1104-0x0000000074E70000-0x0000000074EA3000-memory.dmp

Filesize
204KB

Download
memory/2904-1105-0x0000000074E70000-0x0000000074EA3000-memory.dmp

Filesize
204KB

Download
memory/2904-1106-0x0000000074E70000-0x0000000074EA3000-memory.dmp

Filesize
204KB

Download
memory/2904-1107-0x0000000074E70000-0x0000000074EA3000-memory.dmp

Filesize
204KB

Download
memory/2904-1083-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1098-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1071-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1096-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1086-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1070-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1090-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1067-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1073-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1088-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1068-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1069-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1080-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2904-1077-0x00000000747B0000-0x0000000074962000-memory.dmp

Filesize
1.7MB

Download
memory/2936-2101-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/2936-2083-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download