Overview

overview

10

Static

static

1

6c014c4359...64.exe

windows7-x64

10

6c014c4359...64.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-11-2024 00:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6c014c435999946756265c8f7ebe8e967ee68d9a79fd458b942a16185e9fb564.exe

  • Size

    123KB

  • MD5

    68fc0a389597e08de8d2668f768283c3

  • SHA1

    ca00a153d98913a1d00ef500b522d9a85de5cb3a

  • SHA256

    6c014c435999946756265c8f7ebe8e967ee68d9a79fd458b942a16185e9fb564

  • SHA512

    8f393fbdab6fdc720156f396d60ef0ecbfaa6485b9c5d375dd1a3bf1f00fb40daa656b39cf2e18641f4692b4d2c1cbd9ccad3b1f52191aac9a83fbaee314d3ca

  • SSDEEP

    1536:ELXB65939tY6HBg4sXJWAchXFW8KfHzb4+LnVRAchXFnIfbmUOcVf2S7naxI:ELk395hYXJWAcm8tWnvAcYfiDoH

Score
10/10
banloaddiscoverydownloaderdropperevasionspywarestealertrojan

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Banload family
    banload
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 2 IoCs
    installer
  • Modifies registry class 55 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6c014c435999946756265c8f7ebe8e967ee68d9a79fd458b942a16185e9fb564.exe
    "C:\Users\Admin\AppData\Local\Temp\6c014c435999946756265c8f7ebe8e967ee68d9a79fd458b942a16185e9fb564.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Users\Admin\AppData\Local\Temp\nsaD477.tmp\GamesManagerInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\nsaD477.tmp\GamesManagerInstaller.exe" -installer.createiwinshortcuts=yes -config.channel=110341560 -config.uri=http://gm/iwin/index.html -config.channelName=Iplay -config.iwinrequest="PF/55/5499671643818231075/13/0"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4584
      • C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe
        "C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe" -config.uri=http://gm/iwin/index.html -config.channel="110341560" -config.iwinrequest="PF/55/5499671643818231075/13/0"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Modifies system certificate store
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3684
        • C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe
          "C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe" --type=renderer --no-sandbox --service-pipe-token=D698E0C7A4FD1ECFF4A4F324D99143E3 --lang=en-US --lang=en-US --log-file="C:\Users\Admin\AppData\Local\GamesManager\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) NextDM/3.9.6.631 Chromium/61.0.0.0 Chrome/61.0.0.0 GamesManager/3.9.6.631 110341560 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPI" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=D698E0C7A4FD1ECFF4A4F324D99143E3 --renderer-client-id=2 --mojo-platform-channel-handle=3044 /prefetch:1
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4692
        • C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe
          "C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe" --type=gpu-process --no-sandbox --lang=en-US --log-file="C:\Users\Admin\AppData\Local\GamesManager\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) NextDM/3.9.6.631 Chromium/61.0.0.0 Chrome/61.0.0.0 GamesManager/3.9.6.631 110341560 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPI" --use-gl=swiftshader-webgl --supports-dual-gpus=false --gpu-driver-bug-workarounds=9,12,23,27,49,84 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --disable-accelerated-video-decode --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --lang=en-US --log-file="C:\Users\Admin\AppData\Local\GamesManager\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) NextDM/3.9.6.631 Chromium/61.0.0.0 Chrome/61.0.0.0 GamesManager/3.9.6.631 110341560 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPI" --service-request-channel-token=6D219E877957AA0FDE44F95037FA550E --mojo-platform-channel-handle=3604 /prefetch:2
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2872
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 808
            5⤵
            • Program crash
            PID:864
        • C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe
          "C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe" --type=gpu-process --no-sandbox --lang=en-US --log-file="C:\Users\Admin\AppData\Local\GamesManager\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) NextDM/3.9.6.631 Chromium/61.0.0.0 Chrome/61.0.0.0 GamesManager/3.9.6.631 110341560 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPI" --use-gl=swiftshader-webgl --supports-dual-gpus=false --gpu-driver-bug-workarounds=9,12,23,27,49,84 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --disable-accelerated-video-decode --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --lang=en-US --log-file="C:\Users\Admin\AppData\Local\GamesManager\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) NextDM/3.9.6.631 Chromium/61.0.0.0 Chrome/61.0.0.0 GamesManager/3.9.6.631 110341560 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPI" --service-request-channel-token=6F0B81F6F8F8AC0EF6FE59A7AC582D41 --mojo-platform-channel-handle=3868 /prefetch:2
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:1288
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 808
            5⤵
            • Program crash
            PID:4484
        • C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe
          "C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe" --type=gpu-process --no-sandbox --lang=en-US --log-file="C:\Users\Admin\AppData\Local\GamesManager\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) NextDM/3.9.6.631 Chromium/61.0.0.0 Chrome/61.0.0.0 GamesManager/3.9.6.631 110341560 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPI" --use-gl=swiftshader-webgl --supports-dual-gpus=false --gpu-driver-bug-workarounds=9,12,23,27,49,84 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --disable-accelerated-video-decode --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --lang=en-US --log-file="C:\Users\Admin\AppData\Local\GamesManager\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) NextDM/3.9.6.631 Chromium/61.0.0.0 Chrome/61.0.0.0 GamesManager/3.9.6.631 110341560 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPI" --service-request-channel-token=3C3B9EF937C7A7A3BBF071548B52E19A --mojo-platform-channel-handle=3752 /prefetch:2
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2688
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 808
            5⤵
            • Program crash
            PID:3444
        • C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe
          "C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe" --type=gpu-process --no-sandbox --lang=en-US --log-file="C:\Users\Admin\AppData\Local\GamesManager\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) NextDM/3.9.6.631 Chromium/61.0.0.0 Chrome/61.0.0.0 GamesManager/3.9.6.631 110341560 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPI" --use-gl=swiftshader-webgl --supports-dual-gpus=false --gpu-driver-bug-workarounds=9,12,23,27,49,84 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --disable-accelerated-video-decode --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --lang=en-US --log-file="C:\Users\Admin\AppData\Local\GamesManager\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) NextDM/3.9.6.631 Chromium/61.0.0.0 Chrome/61.0.0.0 GamesManager/3.9.6.631 110341560 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPI" --service-request-channel-token=5C9AF1D6F5D2216526A7AF82B7DBB03E --mojo-platform-channel-handle=3820 /prefetch:2
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:852
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 808
            5⤵
            • Program crash
            PID:4892
        • C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe
          "C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe" -gamestring=55 /S
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4868
        • C:\Users\Admin\AppData\Local\UGMgames\110341560\55\Jewel Quest\GLWorker.exe
          "C:\Users\Admin\AppData\Local\UGMgames\110341560\55\Jewel Quest\GLWorker.exe" ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid5499671643750529305
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:2996
        • C:\Users\Admin\AppData\Local\UGMgames\110341560\55\Jewel Quest\GLWorker.exe
          "C:\Users\Admin\AppData\Local\UGMgames\110341560\55\Jewel Quest\GLWorker.exe" ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid5499671643750529305
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:4404
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x4f4 0x2f4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2656
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2872 -ip 2872
    1⤵
      PID:1732
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1288 -ip 1288
      1⤵
        PID:3300
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2688 -ip 2688
        1⤵
          PID:2660
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 852 -ip 852
          1⤵
            PID:3372

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\GamesManager\110402287\cdata.dat
            Filesize

            380KB

            MD5

            ca17a91ba93ac3107487483aff70f7b4

            SHA1

            3cc944baa4b652889d447556132c2216fd32f781

            SHA256

            e2adb14b28525bdf844cec0ed47d51232f705489ecb548053c30b5040832ae00

            SHA512

            745aebeac40d716e7cef02a11bab0083e20554fc741ec3edd1456912dbe02c74559d791b3bc6ee7adfb018deb6bb231b8f0f88cc7a417f40219c7c2b48d1fda9

            Download Submit

          • C:\Users\Admin\AppData\Local\GamesManager\20000002\channel.ico
            Filesize

            17KB

            MD5

            fbcad071529c2eb58475faf63d477023

            SHA1

            1c4a36142ff3042bb30aaf242791d3b26b9865c4

            SHA256

            1e53c4fc7d6181d4c69e4adf2500d4e1c329c4b491dfad240119479531967dfa

            SHA512

            0231a1d5e1e578cb1d381955299fd6427363d34ffe232b3e9e8c06f55763fbde0a2cb00cbe7be5f069bd1292e26161d8274cdc18d69bf427944ab28722e56b21

            Download Submit

          • C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe
            Filesize

            3.7MB

            MD5

            ff948b22cb83729c3825101e506319f2

            SHA1

            c1f8f7f7241465a378740cf14c3003818855d8c2

            SHA256

            4498cac4be3beb2f0733ab6e0d5a3add87270920a4ef08a7f82f46f98fa1cc2a

            SHA512

            81cf71f9571df6905309edd770ebdb9170b1a1d678bd1187100e43e8f336934080cfeb59558c2d18f05a110d6be2e9860d29419bf2831cb9108495af6538cfd7

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nsaD477.tmp\GamesManagerInstaller.exe
            Filesize

            44.1MB

            MD5

            1614a4e091c3e4f6cdf345d3b2ad1339

            SHA1

            db8c06c407c79bf51ce3efebb228a9114c9b979e

            SHA256

            1fbc927f228f5d1a33ecc7faf44aea4c4e2c17a7080bdcaba2d6e094d9749506

            SHA512

            5e5b337b306983e73be46e7bd4ac50cb01e317622b0c1de8aff71d050e85c120447b0dd1fff28e0de19a3d13542b1dac836d6c8bdd92b5238e57e59759e76fb1

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nsaD477.tmp\NSISdl.dll
            Filesize

            14KB

            MD5

            a5f8399a743ab7f9c88c645c35b1ebb5

            SHA1

            168f3c158913b0367bf79fa413357fbe97018191

            SHA256

            dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

            SHA512

            824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nsaD477.tmp\System.dll
            Filesize

            11KB

            MD5

            c17103ae9072a06da581dec998343fc1

            SHA1

            b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

            SHA256

            dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

            SHA512

            d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nse59DF.tmp\System.dll
            Filesize

            10KB

            MD5

            56a321bd011112ec5d8a32b2f6fd3231

            SHA1

            df20e3a35a1636de64df5290ae5e4e7572447f78

            SHA256

            bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

            SHA512

            5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nsxD771.tmp\INetC.dll
            Filesize

            25KB

            MD5

            e7ebd034dacf96fcc0c7a35c62477d21

            SHA1

            cd372d0607d94b48ac84a1738ed434df4d882f22

            SHA256

            dc84aa66f398781fe76eecf90fc6613f729076552d4b268269228b754bfd70d2

            SHA512

            df367b39c7c62ba2df1d50cbe3dbc97a7a2719fae7684330b4df971f0742c3447f0beb2d295a206522bbce6fbd0053d188d159f7236b6953d35cbf51aecc1bf3

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nsxD771.tmp\System.dll
            Filesize

            11KB

            MD5

            bf712f32249029466fa86756f5546950

            SHA1

            75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

            SHA256

            7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

            SHA512

            13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nsxD771.tmp\nsProcess.dll
            Filesize

            4KB

            MD5

            f0438a894f3a7e01a4aae8d1b5dd0289

            SHA1

            b058e3fcfb7b550041da16bf10d8837024c38bf6

            SHA256

            30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

            SHA512

            f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe
            Filesize

            77KB

            MD5

            455171a0d8585480d318102d13ca1faf

            SHA1

            16263b90994f2882ae03d8d190dca0df1204c0a2

            SHA256

            626953268197dacf5491197a3c4c60b4f2a14c3e878efb640eb48f34c9b23e31

            SHA512

            8961af0da23f63f5f4fa258bc6532e7ba95ffcdfed71ab813fa0715696b70452f4ef127ed08391edf22dd1fe01e38ee1921551ecba9bb5a79ef18d44ca16d11d

            Download Submit

          • C:\Users\Admin\AppData\Local\UGMgames\110341560\55\Jewel Quest\game.zip
            Filesize

            12.8MB

            MD5

            49aad72e86565fcb320d2f6370f27225

            SHA1

            ac05eb7c2bcd79e9599a94492a5a55396dc97e45

            SHA256

            dc1babcda4e7fff6f9ca7e5ed81b2231604e5473e55275343560bb62925ea5b4

            SHA512

            0b86ba7722e894564a50c4376a87237dd3a2be45fb9cbaf5bd0c8269b5d28d9674e03651b29124e20c8f520d80e6634e7f1fb7a9a9b15a90ecd20e624a7b0890

            Download Submit

          • memory/2996-1194-0x0000000002AB0000-0x0000000002CBC000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/2996-1201-0x0000000000400000-0x000000000060C000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/2996-1192-0x0000000000400000-0x000000000060C000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/2996-1198-0x0000000002AB0000-0x0000000002CBC000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/2996-1206-0x0000000002AB0000-0x0000000002CBC000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/2996-1207-0x0000000000400000-0x000000000060C000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/2996-1204-0x0000000002AB0000-0x0000000002CBC000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/2996-1202-0x0000000000400000-0x000000000060C000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/2996-1203-0x0000000000400000-0x000000000060C000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/4404-1217-0x0000000002A20000-0x0000000002C2C000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/4404-1221-0x0000000002A20000-0x0000000002C2C000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/4404-1225-0x0000000000400000-0x000000000060C000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/4404-1228-0x0000000002A20000-0x0000000002C2C000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/4404-1232-0x0000000002A20000-0x0000000002C2C000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/4404-1234-0x0000000000400000-0x000000000060C000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/4404-1227-0x0000000000400000-0x000000000060C000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/4404-1226-0x0000000000400000-0x000000000060C000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/4692-665-0x00000000017B0000-0x00000000017B1000-memory.dmp

            Filesize

            4KB

            Download