Malware Analysis Report

2024-10-16 03:32

Sample ID 240930-q3jmessepg
Target file.exe
SHA256 37c2b040bf4aad7189adcd32f1021208622754c043d6e3f8b4afa5dc9f078ee0
Tags
banload discovery downloader dropper evasion spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

37c2b040bf4aad7189adcd32f1021208622754c043d6e3f8b4afa5dc9f078ee0

Threat Level: Known bad

The file file.exe was found to be: Known bad.

Malicious Activity Summary

banload discovery downloader dropper evasion spyware stealer trojan

Banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks BIOS information in registry

Reads user/profile data of web browsers

Checks installed software on the system

System Location Discovery: System Language Discovery

Enumerates physical storage devices

NSIS installer

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies system certificate store

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-30 13:47

Signatures

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-30 13:47

Reported

2024-09-30 13:49

Platform

win10v2004-20240802-en

Max time kernel

136s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Banload

trojan dropper downloader banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsk439D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\nsk439D.tmp\GamesManagerInstaller.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\okYxtgbVp = "^DERxjA`z_|mhGE\x7fUsY" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\qvLpovzEsmf = "YShF\\BcAN_doQOIlN[]" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\ovGgh = "@[PqEYKoxvdaun~OMUI\\pLK|\x7f" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\eoeDaTxvgon = "|BHjtkcEv_tPm~]pdrYh" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\InprocServer32\ = "%CommonProgramFiles%\\Microsoft Shared\\DAO\\dao360.dll" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\bjlzzbdjisnj = "dowQwBTbXoT_AfArQSYwcc_Z\x7fTOz}n@" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\okYxtgbVp = "uC`PGAyKmsofyz[sxcm" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\ovGgh = "@[PqEYKoxvdaun~OMUI\\pLK|\x7f" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\InprocServer32\Class = "dao.FieldClass" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\crxgpqq = "LGi^ixvw`p{LGdKYxpsK" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\okYxtgbVp = "^DERxjA`Z_|mhDeZspD" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\crxgpqq = "LGi^ixvw`p{LGdKYxpsK" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\okYxtgbVp = "^DERxjAaZ_|mhEeBAqV" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\crxgpqq = "d]CZY_gkiuRtBN\\i|Hy}" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\okYxtgbVp = "^DERxjAcj_|mhGt\x7fFrF" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\okYxtgbVp = "uC`PGAyKMsofyy{V^`p" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\eoeDaTxvgon = "x~Fzzzb|S{N{TDouOu[v" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\SGxiuk = "VgridRgis}KXmBsKX_w{x{p]Gtg^BF" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\SGxiuk = "XGwZ@NJADsUmSqJscFtWJZu^eRZEF~" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\eoeDaTxvgon = "x~Fzzzb|S{N{TDouOu[v" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\ = "DAO.Field.36" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\ProgID C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\InprocServer32\Assembly = "dao, Version=10.0.4504.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\InprocServer32\RuntimeVersion = "v1.0.3705" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\SGxiuk = "VgridRgis}KXmBsKX_w{x{p]Gtg^BF" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\okYxtgbVp = "uC`PGAyK}sofyxkyncP" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\SGxiuk = "VgridRgis}KHmBsKX_wkx{p]Gtg^BF" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\bjlzzbdjisnj = "daI\\RYsZkxwiM`{LACXwrh^NINllirh" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\ovGgh = "RxUrDUudI{AqPltR~D_aPt\x7fDq" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\{ABB2D038-7B8A-13D1-B2E4-0060975B8649} C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\eoeDaTxvgon = "|BHjtkcEv_tPm~]pdrYh" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\bjlzzbdjisnj = "dowQwBTbXoT_AfArQSYwcc_Z\x7fTOz}n@" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\qvLpovzEsmf = "tBBSv\\^dqLOfO\\Rr}\x7fs" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\SGxiuk = "XGwZ@NJADsU}SqJscFtGJZu^eRZEF~" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\okYxtgbVp = "uC`PGAyK]sofy{K\\H`M" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\okYxtgbVp = "^DERxjAcz_|mhEDuPr{" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\ovGgh = "RxUrDUudI{AqPltR~D_aPt\x7fDq" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\crxgpqq = "d]CZY_gkiuRtBN\\i|Hy}" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\ProgID\ = "DAO.Field.36" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\okYxtgbVp = "^DERxjAcJ_|mhEUyssO" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\okYxtgbVp = "uC`PGAyH}sofy{kPx`f" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\okYxtgbVp = "uC`PGAyHMsofy{z\\[aR" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\InprocServer32 C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\qvLpovzEsmf = "tBBSv\\^dqLOfO\\Rr}\x7fs" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\okYxtgbVp = "uC`PGAyH]sofyyJVMao" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\bjlzzbdjisnj = "daI\\RYsZkxwiM`{LACXwrh^NINllirh" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\okYxtgbVp = "^DERxjA`J_|mhFUPepy" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\okYxtgbVp = "^DERxjA`j_|mhEuuCsd" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\SGxiuk = "VgridRgis}KhmBsKX_wKx{p]Gtg^BF" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\SGxiuk = "XGwZ@NJADsU]SqJscFtgJZu^eRZEF~" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\qvLpovzEsmf = "YShF\\BcAN_doQOIlN[]" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\SGxiuk = "XGwZ@NJADsUmSqJscFtWJZu^eRZEF~" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\okYxtgbVp = "uC`PGAyJmsofy{[kJb\x7f" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0} C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\InprocServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1660 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\nsk439D.tmp\GamesManagerInstaller.exe
PID 1660 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\nsk439D.tmp\GamesManagerInstaller.exe
PID 1660 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\nsk439D.tmp\GamesManagerInstaller.exe
PID 4600 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\nsk439D.tmp\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe
PID 4600 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\nsk439D.tmp\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe
PID 4600 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\nsk439D.tmp\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe
PID 2152 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe
PID 2152 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe
PID 2152 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe
PID 2152 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2152 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2152 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2352 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2352 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2352 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2352 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2352 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2352 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2352 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe
PID 2352 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe
PID 2352 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe
PID 2352 wrote to memory of 704 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe
PID 2352 wrote to memory of 704 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe
PID 2352 wrote to memory of 704 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe
PID 2352 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe
PID 2352 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe
PID 2352 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1436,i,3210801877307184477,8078594481454001567,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\nsk439D.tmp\GamesManagerInstaller.exe

"C:\Users\Admin\AppData\Local\Temp\nsk439D.tmp\GamesManagerInstaller.exe" -installer.createiwinshortcuts=yes -config.channel=20000009 -config.uri=https://ugm3-msn.iwin.com/ -config.channelName=MsnStreaming -config.iwinrequest="PF/1735198334008948550/zengems/51/0"

C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe

"C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe" -installer.logstartsent=true -config.channel=20000009 -config.uri="https://ugm3-msn.iwin.com/" -config.channelName="iWin" -config.sku=FIRST_INSTALL -installer.createshortcutswithname="MSN Games Manager" -autoupdate=1 -config.iwinrequest="PF/1735198334008948550/zengems/51/0"

C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe

"C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe" /S --no-desktop-shortcut

C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe

"C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe" -config.uri=https://ugm3-msn.iwin.com/ -config.channel="20000009" -config.sku="FIRST_INSTALL" -config.iwinrequest="PF/1735198334008948550/zengems/51/0"

C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe

"C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe" --type=renderer --no-sandbox --service-pipe-token=5CD475E61A0F5EB4365C3B0FE0E6959D --lang=en-US --lang=en-US --log-file="C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPI" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=5CD475E61A0F5EB4365C3B0FE0E6959D --renderer-client-id=2 --mojo-platform-channel-handle=2900 /prefetch:1

C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe

"C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe" --type=renderer --no-sandbox --service-pipe-token=E201E49D1CDDEA0ABFB98D227D3A6610 --lang=en-US --lang=en-US --log-file="C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPI" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=E201E49D1CDDEA0ABFB98D227D3A6610 --renderer-client-id=3 --mojo-platform-channel-handle=3300 /prefetch:1

C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe

C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid5499907879973995496

C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe

C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid5499907879973995496

C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe

C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid5499907879973995496

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 p.iwin.com udp
CZ 65.9.95.117:80 p.iwin.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 117.95.9.65.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 events.iwin.com udp
US 107.23.182.116:80 events.iwin.com tcp
US 8.8.8.8:53 116.182.23.107.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 107.23.182.116:80 events.iwin.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 ugm3-msn.iwin.com udp
US 23.21.169.183:443 ugm3-msn.iwin.com tcp
US 8.8.8.8:53 94.95.9.65.in-addr.arpa udp
US 8.8.8.8:53 183.169.21.23.in-addr.arpa udp
US 23.21.169.183:443 ugm3-msn.iwin.com tcp
US 8.8.8.8:53 play.iwincdn.com udp
FR 68.232.35.54:443 play.iwincdn.com tcp
FR 68.232.35.54:443 play.iwincdn.com tcp
FR 68.232.35.54:443 play.iwincdn.com tcp
US 8.8.8.8:53 static.iwincdn.com udp
US 8.8.8.8:53 54.35.232.68.in-addr.arpa udp
US 8.8.8.8:53 js.maxmind.com udp
FR 68.232.35.54:443 static.iwincdn.com tcp
US 162.159.134.22:443 js.maxmind.com tcp
US 8.8.8.8:53 geoip-js.com udp
US 8.8.8.8:53 connect.facebook.net udp
US 8.8.8.8:53 events.iwin.com udp
US 172.64.154.146:443 geoip-js.com tcp
GB 163.70.147.23:443 connect.facebook.net tcp
GB 163.70.147.23:443 connect.facebook.net tcp
US 52.2.184.42:443 events.iwin.com tcp
US 52.2.184.42:443 events.iwin.com tcp
US 8.8.8.8:53 22.134.159.162.in-addr.arpa udp
US 8.8.8.8:53 146.154.64.172.in-addr.arpa udp
US 8.8.8.8:53 23.147.70.163.in-addr.arpa udp
GB 163.70.147.23:443 connect.facebook.net tcp
US 8.8.8.8:53 www.facebook.com udp
GB 163.70.147.35:443 www.facebook.com tcp
US 8.8.8.8:53 dls.iwincdn.com udp
FR 68.232.35.54:443 dls.iwincdn.com tcp
US 8.8.8.8:53 42.184.2.52.in-addr.arpa udp
US 8.8.8.8:53 200.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsk439D.tmp\System.dll

MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

C:\Users\Admin\AppData\Local\Temp\nsk439D.tmp\NSISdl.dll

MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

C:\Users\Admin\AppData\Local\Temp\nsp84BC.tmp\INetC.dll

MD5 e7ebd034dacf96fcc0c7a35c62477d21
SHA1 cd372d0607d94b48ac84a1738ed434df4d882f22
SHA256 dc84aa66f398781fe76eecf90fc6613f729076552d4b268269228b754bfd70d2
SHA512 df367b39c7c62ba2df1d50cbe3dbc97a7a2719fae7684330b4df971f0742c3447f0beb2d295a206522bbce6fbd0053d188d159f7236b6953d35cbf51aecc1bf3

C:\Users\Admin\AppData\Local\Temp\nsx8B45.tmp\nsProcess.dll

MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

C:\Users\Admin\AppData\Local\Temp\nsx8B45.tmp\System.dll

MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

C:\Users\Admin\AppData\Roaming\MSN Games Notifier\installer.exe

MD5 736dab2d03b65e0f72144e7ae4550d14
SHA1 3ea064ea3fdf47434381d71160af195a9c55c59c
SHA256 06804190dc0712ecb9f92eca846898c441f6e3302a0d5c1087e9299a6311672a
SHA512 db57b714810be7ce3b774215b516ad05072bc220a6261d8f0de868bdaa0f32edd86e60c031e38c8e6cb2e99738c0ba0b30a7296296f169490ef6ee8b0ee02530

C:\Users\Admin\AppData\Local\Temp\nswC7FF.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe

MD5 a6459cb0905d774983ee0fe1320d6d13
SHA1 5e62f1b56fb76f95f7f9d08c2a47506314d32f67
SHA256 e70670dac2ce844ae9828b20f3349b5c25eb8a05d39c1be5dc867e27f474c26a
SHA512 ba61dc7ea1c2763411f1df3b77e1c1769dd59fa4bbed2e51a8a38b0d64e7a0215d463f267757ad45c95c3e4711427bdb522ceb7dcb1243e6b82c233ca016157f

memory/2456-815-0x0000000001080000-0x0000000001081000-memory.dmp

memory/1644-825-0x00000000018B0000-0x00000000018B1000-memory.dmp

C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\database\textures\particles\particle-trail-destroyrock.xit

MD5 0334ef1047d0e407171d6d5e165b9e02
SHA1 1be2a97fbeec91f86bfa6d5fb2318f78a4b62722
SHA256 4e688892d551436f1a10ba5f272af6cf279ce57add65370ac4cde76b8b6962bf
SHA512 eb231cfe768cfabc840a06130ff31b259f1625c3f931d4e489d5f7dc966be99d26013abec87148e49e13a16f28932b8662895c302459a1e979a366d1127a9175

memory/4760-1684-0x0000000000400000-0x000000000060C000-memory.dmp

memory/4760-1686-0x0000000002AB0000-0x0000000002CBC000-memory.dmp

memory/4760-1690-0x0000000002AB0000-0x0000000002CBC000-memory.dmp

memory/4760-1693-0x0000000000400000-0x000000000060C000-memory.dmp

memory/4760-1694-0x0000000000400000-0x000000000060C000-memory.dmp

memory/4760-1695-0x0000000000400000-0x000000000060C000-memory.dmp

memory/4760-1696-0x0000000002AB0000-0x0000000002CBC000-memory.dmp

memory/4760-1699-0x0000000000400000-0x000000000060C000-memory.dmp

memory/4760-1698-0x0000000002AB0000-0x0000000002CBC000-memory.dmp

memory/704-1705-0x0000000002900000-0x0000000002B0C000-memory.dmp

memory/704-1709-0x0000000002900000-0x0000000002B0C000-memory.dmp

memory/704-1714-0x0000000000400000-0x000000000060C000-memory.dmp

memory/704-1716-0x0000000002900000-0x0000000002B0C000-memory.dmp

memory/704-1720-0x0000000002900000-0x0000000002B0C000-memory.dmp

memory/704-1722-0x0000000000400000-0x000000000060C000-memory.dmp

memory/3996-1729-0x0000000002A50000-0x0000000002C5C000-memory.dmp

memory/3996-1725-0x0000000002A50000-0x0000000002C5C000-memory.dmp

memory/3996-1724-0x0000000000400000-0x000000000060C000-memory.dmp

memory/704-1715-0x0000000000400000-0x000000000060C000-memory.dmp

memory/704-1713-0x0000000000400000-0x000000000060C000-memory.dmp

memory/3996-1733-0x0000000000400000-0x000000000060C000-memory.dmp

memory/3996-1734-0x0000000000400000-0x000000000060C000-memory.dmp

memory/3996-1736-0x0000000002A50000-0x0000000002C5C000-memory.dmp

memory/3996-1735-0x0000000000400000-0x000000000060C000-memory.dmp

memory/3996-1740-0x0000000002A50000-0x0000000002C5C000-memory.dmp

memory/3996-1742-0x0000000000400000-0x000000000060C000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-30 13:47

Reported

2024-09-30 13:49

Platform

win7-20240903-en

Max time kernel

136s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Banload

trojan dropper downloader banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsj31FA.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsj31FA.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\nsj31FA.tmp\GamesManagerInstaller.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\Version C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\krbE = "dI{AqPltR~D_aPt\x7fDq^DERxjAcz_" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\wmXiAxsLtdN = "DsUmSqJscFtWJZu^eRZEF~@[PqEYK" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\wmXiAxsLtdN = "s}KHmBsKX_wkx{p]Gtg^BFRxUrDUu" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\dNWqButkkf = "ofyyJoysO" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\InprocServer32\14.0.0.0\RuntimeVersion = "v2.0.50727" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\VersionIndependentProgID C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\dNWqButkkf = "ofyxZ@Ipo" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\tjxqRO = "S{N{TDouOu[vYShF\\" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\tjxqRO = "v_tPm~]pdrYhtBBSv" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\wmXiAxsLtdN = "s}KXmBsKX_w{x{p]Gtg^BFRxUrDUu" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\krbE = "oxvdaun~OMUI\\pLK|\x7fuC`PGAyK}s" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\krbE = "dI{AqPltR~D_aPt\x7fDq^DERxjA`z_" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\VersionIndependentProgID\ = "Outlook.OlkInfoBar" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\krbE = "dI{AqPltR~D_aPt\x7fDq^DERxjAcJ_" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\ElmEtXDW = "\\^dqLOfO\\Rr}\x7fsXGeObauA" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\dNWqButkkf = "|mhGEFaay" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\dNWqButkkf = "ofy{Ke|rm" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\krbE = "oxvdaun~OMUI\\pLK|\x7fuC`PGAyJms" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\InprocServer32\RuntimeVersion = "v2.0.50727" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\InprocServer32\14.0.0.0\Class = "Microsoft.Office.Interop.Outlook.OlkInfoBarClass" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\ElmEtXDW = "BcAN_doQOIlN[]Vg`|F}Xi" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\ProgID\ = "Outlook.OlkInfoBar.1" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\wmXiAxsLtdN = "DsU]SqJscFtgJZu^eRZEF~@[PqEYK" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\dNWqButkkf = "ofyy{ojrP" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\mrmjdP = "lirhd]CZY_gkiuRtBN\\i|Hy}x~Fzzzb|" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\dNWqButkkf = "|mhGdqpbT" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\Control C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\dNWqButkkf = "|mhFdiBcF" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\dNWqButkkf = "|mhGtFr`f" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\krbE = "dI{AqPltR~D_aPt\x7fDq^DERxjA`j_" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\InprocServer32\14.0.0.0 C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\OUTLOOK.EXE\"" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\mrmjdP = "lirhd]CZY_gkiuRtBN\\i|Hy}x~Fzzzb|" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{ABB2D038-7B8A-13D1-B2E4-0060975B8649} C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\mcMfJptZxfxo = "daI\\RYsZkxwiM`{LACXwrh^NINl" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\Typelib\ = "{00062FFF-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\wmXiAxsLtdN = "DsUmSqJscFtWJZu^eRZEF~@[PqEYK" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\mcMfJptZxfxo = "dowQwBTbXoT_AfArQSYwcc_Z\x7fTO" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\mrmjdP = "z}n@LGi^ixvw`p{LGdKYxpsK|BHjtkcE" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\dNWqButkkf = "ofyzjJ_pR" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\wmXiAxsLtdN = "DsU}SqJscFtGJZu^eRZEF~@[PqEYK" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\ = "Microsoft Outlook InfoBar Control" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\LocalServer32 C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\ToolboxBitmap32 C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\mcMfJptZxfxo = "dowQwBTbXoT_AfArQSYwcc_Z\x7fTO" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\krbE = "oxvdaun~OMUI\\pLK|\x7fuC`PGAyH]s" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\dNWqButkkf = "ofy{zeosr" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\krbE = "oxvdaun~OMUI\\pLK|\x7fuC`PGAyK]s" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0} C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\InprocServer32 C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\ToolboxBitmap32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\OUTLOOK.EXE,5515" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\Typelib C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\ElmEtXDW = "\\^dqLOfO\\Rr}\x7fsXGeObauA" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\tjxqRO = "S{N{TDouOu[vYShF\\" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\krbE = "dI{AqPltR~D_aPt\x7fDq^DERxjAcj_" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\dNWqButkkf = "|mhEuLwaD" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\InprocServer32\Assembly = "Microsoft.Office.Interop.Outlook, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{ABB2D038-7B8A-13D1-B2E4-0060975B8649}\dNWqButkkf = "ofyyZX{q}" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\krbE = "dI{AqPltR~D_aPt\x7fDq^DERxjAaZ_" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\mcMfJptZxfxo = "daI\\RYsZkxwiM`{LACXwrh^NINl" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\dNWqButkkf = "|mhGTJB`M" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\ElmEtXDW = "BcAN_doQOIlN[]Vg`|F}Xi" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BCA01928-751C-E6A9-C3A8-5D684D7DD9B0}\dNWqButkkf = "|mhDTcTc{" C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6 C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 4b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9040000000100000010000000285ec909c4ab0d2d57f5086b225799aa1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c2000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2252 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\nsj31FA.tmp\GamesManagerInstaller.exe
PID 2252 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\nsj31FA.tmp\GamesManagerInstaller.exe
PID 2252 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\nsj31FA.tmp\GamesManagerInstaller.exe
PID 2252 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\nsj31FA.tmp\GamesManagerInstaller.exe
PID 2252 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\nsj31FA.tmp\GamesManagerInstaller.exe
PID 2252 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\nsj31FA.tmp\GamesManagerInstaller.exe
PID 2252 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\nsj31FA.tmp\GamesManagerInstaller.exe
PID 2736 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\nsj31FA.tmp\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe
PID 2736 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\nsj31FA.tmp\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe
PID 2736 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\nsj31FA.tmp\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe
PID 2736 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\nsj31FA.tmp\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe
PID 2736 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\nsj31FA.tmp\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe
PID 2736 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\nsj31FA.tmp\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe
PID 2736 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\nsj31FA.tmp\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe
PID 2448 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe
PID 2448 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe
PID 2448 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe
PID 2448 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe
PID 2448 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe
PID 2448 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe
PID 2448 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe
PID 2448 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2448 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2448 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2448 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
PID 2920 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe
PID 2920 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe
PID 2920 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe
PID 2920 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe
PID 2920 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe
PID 2920 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe
PID 2920 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe
PID 2920 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe
PID 2920 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe
PID 2920 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe
PID 2920 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe
PID 2920 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\nsj31FA.tmp\GamesManagerInstaller.exe

"C:\Users\Admin\AppData\Local\Temp\nsj31FA.tmp\GamesManagerInstaller.exe" -installer.createiwinshortcuts=yes -config.channel=20000009 -config.uri=https://ugm3-msn.iwin.com/ -config.channelName=MsnStreaming -config.iwinrequest="PF/1735198334008948550/zengems/51/0"

C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe

"C:\Users\Admin\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe" -installer.logstartsent=true -config.channel=20000009 -config.uri="https://ugm3-msn.iwin.com/" -config.channelName="iWin" -config.sku=FIRST_INSTALL -installer.createshortcutswithname="MSN Games Manager" -autoupdate=1 -config.iwinrequest="PF/1735198334008948550/zengems/51/0"

C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe

"C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe" /S --no-desktop-shortcut

C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe

"C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe" -config.uri=https://ugm3-msn.iwin.com/ -config.channel="20000009" -config.sku="FIRST_INSTALL" -config.iwinrequest="PF/1735198334008948550/zengems/51/0"

C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe

"C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe" --type=renderer --no-sandbox --service-pipe-token=8497A98B47CC5BCF2B71FAEA4EDF3784 --lang=en-US --lang=en-US --log-file="C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/6.1 [x64] CEF/3.3163.1651.gf229796 UAPI" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=8497A98B47CC5BCF2B71FAEA4EDF3784 --renderer-client-id=2 --mojo-platform-channel-handle=1984 /prefetch:1

C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe

"C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe" --type=renderer --no-sandbox --service-pipe-token=E05A304D15CF632BFF8F6A36E3B8326E --lang=en-US --lang=en-US --log-file="C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/6.1 [x64] CEF/3.3163.1651.gf229796 UAPI" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=E05A304D15CF632BFF8F6A36E3B8326E --renderer-client-id=3 --mojo-platform-channel-handle=2320 /prefetch:1

C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe

"C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe" --type=gpu-process --no-sandbox --lang=en-US --log-file="C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/6.1 [x64] CEF/3.3163.1651.gf229796 UAPI" --disable-direct-composition --use-gl=swiftshader-webgl --supports-dual-gpus=false --gpu-driver-bug-workarounds=9,12,13,22,23,24,27,49,84 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --disable-accelerated-video-decode --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --lang=en-US --log-file="C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/6.1 [x64] CEF/3.3163.1651.gf229796 UAPI" --service-request-channel-token=7411F2B1F426580E6ADEDA6DA8C53E66 --mojo-platform-channel-handle=3144 /prefetch:2

C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe

"C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe" --type=gpu-process --no-sandbox --lang=en-US --log-file="C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/6.1 [x64] CEF/3.3163.1651.gf229796 UAPI" --disable-direct-composition --use-gl=swiftshader-webgl --supports-dual-gpus=false --gpu-driver-bug-workarounds=9,12,13,22,23,24,27,49,84 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --disable-accelerated-video-decode --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --lang=en-US --log-file="C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/6.1 [x64] CEF/3.3163.1651.gf229796 UAPI" --service-request-channel-token=1456466B4B4B3C5FA208C68EC78B9E67 --mojo-platform-channel-handle=3164 /prefetch:2

C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe

"C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe" --type=gpu-process --no-sandbox --lang=en-US --log-file="C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/6.1 [x64] CEF/3.3163.1651.gf229796 UAPI" --disable-direct-composition --use-gl=swiftshader-webgl --supports-dual-gpus=false --gpu-driver-bug-workarounds=9,12,13,22,23,24,27,49,84 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --disable-accelerated-video-decode --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --lang=en-US --log-file="C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/6.1 [x64] CEF/3.3163.1651.gf229796 UAPI" --service-request-channel-token=42400EA58B5AF2F56CB20A37664C001E --mojo-platform-channel-handle=3040 /prefetch:2

C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe

"C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe" --type=gpu-process --no-sandbox --lang=en-US --log-file="C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/6.1 [x64] CEF/3.3163.1651.gf229796 UAPI" --disable-direct-composition --use-gl=swiftshader-webgl --supports-dual-gpus=false --gpu-driver-bug-workarounds=9,12,13,22,23,24,27,49,84 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --disable-accelerated-video-decode --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --lang=en-US --log-file="C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/6.1 [x64] CEF/3.3163.1651.gf229796 UAPI" --service-request-channel-token=38DDADE294B8CB1348EA8655D0FCCA14 --mojo-platform-channel-handle=3144 /prefetch:2

C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe

C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid5499907879973995496

C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe

C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid5499907879973995496

C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe

C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid5499907879973995496

Network

Country Destination Domain Proto
US 8.8.8.8:53 p.iwin.com udp
CZ 65.9.95.120:80 p.iwin.com tcp
US 8.8.8.8:53 events.iwin.com udp
US 52.2.184.42:80 events.iwin.com tcp
US 52.2.184.42:80 events.iwin.com tcp
US 8.8.8.8:53 ugm3-msn.iwin.com udp
US 54.89.18.50:443 ugm3-msn.iwin.com tcp
US 54.89.18.50:443 ugm3-msn.iwin.com tcp
US 8.8.8.8:53 play.iwincdn.com udp
FR 68.232.35.54:443 play.iwincdn.com tcp
FR 68.232.35.54:443 play.iwincdn.com tcp
FR 68.232.35.54:443 play.iwincdn.com tcp
US 8.8.8.8:53 static.iwincdn.com udp
US 8.8.8.8:53 js.maxmind.com udp
FR 68.232.35.54:443 static.iwincdn.com tcp
US 162.159.135.22:443 js.maxmind.com tcp
US 8.8.8.8:53 connect.facebook.net udp
GB 163.70.147.23:443 connect.facebook.net tcp
US 8.8.8.8:53 events.iwin.com udp
GB 163.70.147.23:443 connect.facebook.net tcp
US 23.21.169.183:443 events.iwin.com tcp
US 23.21.169.183:443 events.iwin.com tcp
US 8.8.8.8:53 geoip-js.com udp
US 172.64.154.146:443 geoip-js.com tcp
GB 163.70.147.23:443 connect.facebook.net tcp
US 8.8.8.8:53 dls.iwincdn.com udp
FR 68.232.35.54:443 dls.iwincdn.com tcp
US 8.8.8.8:53 udp
GB 163.70.147.35:443 tcp

Files

\Users\Admin\AppData\Local\Temp\nsj31FA.tmp\System.dll

MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

\Users\Admin\AppData\Local\Temp\nsj31FA.tmp\NSISdl.dll

MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

\Users\Admin\AppData\Local\Temp\nso76A7.tmp\INetC.dll

MD5 e7ebd034dacf96fcc0c7a35c62477d21
SHA1 cd372d0607d94b48ac84a1738ed434df4d882f22
SHA256 dc84aa66f398781fe76eecf90fc6613f729076552d4b268269228b754bfd70d2
SHA512 df367b39c7c62ba2df1d50cbe3dbc97a7a2719fae7684330b4df971f0742c3447f0beb2d295a206522bbce6fbd0053d188d159f7236b6953d35cbf51aecc1bf3

\Users\Admin\AppData\Local\Temp\nst81BF.tmp\nsProcess.dll

MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

\Users\Admin\AppData\Local\Temp\nst81BF.tmp\System.dll

MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

C:\Users\Admin\AppData\Roaming\MSN Games Notifier\installer.exe

MD5 736dab2d03b65e0f72144e7ae4550d14
SHA1 3ea064ea3fdf47434381d71160af195a9c55c59c
SHA256 06804190dc0712ecb9f92eca846898c441f6e3302a0d5c1087e9299a6311672a
SHA512 db57b714810be7ce3b774215b516ad05072bc220a6261d8f0de868bdaa0f32edd86e60c031e38c8e6cb2e99738c0ba0b30a7296296f169490ef6ee8b0ee02530

C:\Users\Admin\AppData\Local\Temp\nsuD847.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

C:\Users\Admin\AppData\Local\Temp\nsuD847.tmp\System.dll

MD5 17ed1c86bd67e78ade4712be48a7d2bd
SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

C:\Users\Admin\AppData\Local\Temp\nsuD847.tmp\StdUtils.dll

MD5 33b4e69e7835e18b9437623367dd1787
SHA1 53afa03edaf931abdc2d828e5a2c89ad573d926c
SHA256 72d38ef115e71fc73dc5978987c583fc8c6b50ff12e4a5d30649a4d164a8b6ae
SHA512 ca890e785d1a0a7e0b4a748416fba417826ae66b46e600f407d4e795b444612a8b830f579f2cf5b6e051bea800604f34f8801cc3daf05c8d29ad05bcda454a77

C:\Users\Admin\AppData\Local\Temp\nsuD847.tmp\nsis7z.dll

MD5 c6a070b3e68b292bb0efc9b26e85e9cc
SHA1 5a922b96eda6595a68fd0a9051236162ff2e2ada
SHA256 66ac8bd1f273a73e17a3f31d6add739d3cb0330a6417faeda11a9cae00b62d8b
SHA512 8eff8fc16f5bb574bd9483e3b217b67a8986e31497368c06fdaa3a1e93a40aee94a5b31729d01905157b0ae1e556a402f43cd29a4d30a0587e1ec334458a44e8

C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe

MD5 a6459cb0905d774983ee0fe1320d6d13
SHA1 5e62f1b56fb76f95f7f9d08c2a47506314d32f67
SHA256 e70670dac2ce844ae9828b20f3349b5c25eb8a05d39c1be5dc867e27f474c26a
SHA512 ba61dc7ea1c2763411f1df3b77e1c1769dd59fa4bbed2e51a8a38b0d64e7a0215d463f267757ad45c95c3e4711427bdb522ceb7dcb1243e6b82c233ca016157f

C:\Users\Admin\AppData\Local\Temp\CabEFAE.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarF1B4.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

memory/864-901-0x00000000009B0000-0x00000000009B1000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 744f774c1e224f357b307c3ba416a3a9
SHA1 88b5a846a5e1492c3b094500d80e23fba10ae15d
SHA256 03c2fad2a1de516774846f4f00c1f75f354487c625e90139a650178c17b19764
SHA512 cabb62e7f79792ff55f799b2344322d828757b05a469a77bc2ecdac250f68b85ac6eb8650b60012dd5504119e320f0165969ff17218618538e4f4f3958bfe069

memory/2884-1019-0x0000000000520000-0x0000000000521000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 14839ca21220df755c3fe5890bc16c37
SHA1 0ae74ef556e3b3457bdb584a8e7a6d8de067f8f4
SHA256 1f53ffd02d5ed385da0ee448e2faf64287e819b364cba0e73a2bb03feb02ef9b
SHA512 8d434584c875ce5a1222d20279026a9f53d2a01ff0c6230c346861ec47458580dd307fc74ca015a335de707a2a441a879e83ca3183d67dc5aec31c0ca31d3e4d

C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\20000009\webdata\GPUCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\20000009\webdata\GPUCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

C:\Users\Admin\AppData\Local\GamesManager_iWin_MSN\20000009\webdata\GPUCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\database\textures\particles\particle-trail-destroyrock.xit

MD5 0334ef1047d0e407171d6d5e165b9e02
SHA1 1be2a97fbeec91f86bfa6d5fb2318f78a4b62722
SHA256 4e688892d551436f1a10ba5f272af6cf279ce57add65370ac4cde76b8b6962bf
SHA512 eb231cfe768cfabc840a06130ff31b259f1625c3f931d4e489d5f7dc966be99d26013abec87148e49e13a16f28932b8662895c302459a1e979a366d1127a9175

C:\Users\Admin\AppData\Local\UGMgames\20000009\zengems\zengems\GLWorker.exe

MD5 9e7fc3bfb9cc10f49c616e7091980859
SHA1 3c57af352658bf4bb2aea5d783495f6d0bf619c8
SHA256 107a9bdef7073d9454d5d5d593fb4d9d6821217e4e3592ef2e9ae78637084b84
SHA512 41faddb9647a6a84da6207dba5af79d5a82a649227df571f79e91813a41ada08242e53d0dfb51969ef68ca3db3fab151f0fbf7d1bb4f6de1f4f096ae9110b358

memory/2920-2022-0x000000000A260000-0x000000000A46C000-memory.dmp

memory/2080-2024-0x0000000002660000-0x000000000286C000-memory.dmp

memory/2080-2023-0x0000000000400000-0x000000000060C000-memory.dmp

memory/2920-2021-0x000000000A260000-0x000000000A46C000-memory.dmp

memory/2080-2028-0x0000000002660000-0x000000000286C000-memory.dmp

memory/2080-2031-0x0000000000400000-0x000000000060C000-memory.dmp

memory/2080-2034-0x0000000002660000-0x000000000286C000-memory.dmp

memory/2080-2033-0x0000000000400000-0x000000000060C000-memory.dmp

memory/2080-2032-0x0000000000400000-0x000000000060C000-memory.dmp

memory/2080-2038-0x0000000000400000-0x000000000060C000-memory.dmp

memory/2080-2036-0x0000000002660000-0x000000000286C000-memory.dmp

memory/2920-2043-0x000000000A260000-0x000000000A46C000-memory.dmp

memory/2484-2044-0x0000000000400000-0x000000000060C000-memory.dmp

memory/2484-2045-0x0000000002810000-0x0000000002A1C000-memory.dmp

memory/2484-2049-0x0000000002810000-0x0000000002A1C000-memory.dmp

memory/2484-2053-0x0000000000400000-0x000000000060C000-memory.dmp

memory/2484-2056-0x0000000002810000-0x0000000002A1C000-memory.dmp

memory/2484-2060-0x0000000002810000-0x0000000002A1C000-memory.dmp

memory/2484-2062-0x0000000000400000-0x000000000060C000-memory.dmp

memory/2484-2055-0x0000000000400000-0x000000000060C000-memory.dmp

memory/2484-2054-0x0000000000400000-0x000000000060C000-memory.dmp

memory/2920-2063-0x000000000A260000-0x000000000A46C000-memory.dmp

memory/2368-2065-0x0000000002470000-0x000000000267C000-memory.dmp

memory/2368-2069-0x0000000002470000-0x000000000267C000-memory.dmp

memory/2368-2064-0x0000000000400000-0x000000000060C000-memory.dmp

memory/2920-2073-0x000000000A260000-0x000000000A46C000-memory.dmp

memory/2368-2074-0x0000000000400000-0x000000000060C000-memory.dmp

memory/2368-2083-0x0000000000400000-0x000000000060C000-memory.dmp

memory/2368-2081-0x0000000002470000-0x000000000267C000-memory.dmp

memory/2368-2077-0x0000000002470000-0x000000000267C000-memory.dmp

memory/2368-2075-0x0000000000400000-0x000000000060C000-memory.dmp

memory/2368-2076-0x0000000000400000-0x000000000060C000-memory.dmp

memory/2920-2092-0x000000000A260000-0x000000000A46C000-memory.dmp