Overview

overview

9

Static

static

1

jaffacakes...pe.exe

windows10-2004-x64

9

jaffacakes...pe.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/10/2026, 03:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_not-a-virus.Downloader.Win32.Agent.kupe.exe
  • Size 112KB
  • Sample261014-ebdfjse191
  • SHA256 fb5d05b3c47b9958caf11a9017f3aa684dde72d24210e39ae8c5b9aabda68ea6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryinstallerspywarestealer

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Downloads MZ/PE file 3 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 7 IoCs
  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 64 IoCs
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 4 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 2 IoCs
    installer
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.kupe.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.kupe.exe"
    1⤵
    • Downloads MZ/PE file
    • Loads dropped DLL
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Users\Admin\AppData\Local\Temp\nsz8374.tmp\GamesManagerInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\nsz8374.tmp\GamesManagerInstaller.exe" -installer.createiwinshortcuts=yes -config.channel=110341560 -config.uri=http://gm/iwin/index.html -config.channelName=Iplay -config.iwinrequest=PF/5498298969203920516/5498298973175097753/13/0
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1856
      • C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe
        "C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe" -gmregchannelid=110341560
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3852
  • C:\Program Files (x86)\GMInstaller\ugm_installer.exe
    "C:\Program Files (x86)\GMInstaller\ugm_installer.exe" -installer.createiwinshortcuts=yes -config.channel=110341560 -config.uri=http://gm/iwin/index.html -config.channelName=Iplay -config.iwinrequest=PF/5498298969203920516/5498298973175097753/13/0
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1616
    • C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe
      "C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe" -config.uri=http://gm/iwin/index.html -config.channel="110341560" -config.iwinrequest="PF/5498298969203920516/5498298973175097753/13/0"
      2⤵
      • Downloads MZ/PE file
      • Checks computer location settings
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1776
      • C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe
        "C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe" --type=renderer --enable-logging --log-level=2 --no-sandbox --user-agent="NextDM/2.16.2.1015 AppleWebKit/535.19 (KHTML, like Gecko) GamesManager/2.16.2.1015 110341560 WinVer/6.2 [x64]" --awesomium-log-path="C:\Users\Admin\AppData\Local\GamesManager\./awesomium.log" --lang --channel=1776.0282FC80.2011679211 /prefetch:3
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        PID:3416
      • C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe
        "C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe" --type=gpu-process --channel=1776.028C6B40.1623387365 --enable-logging --log-level=2 --no-sandbox --awesomium-log-path="C:\Users\Admin\AppData\Local\GamesManager\./awesomium.log" /prefetch:12
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        PID:4392
      • C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe
        "C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe" -gmregcopysrc="HKEY_LOCAL_MACHINE\Software\iWinArcade" -gmregcopydest="HKEY_CURRENT_USER\Software\IplayArcade" -gmregcopylocalmachinedest="HKEY_LOCAL_MACHINE\Software\IplayArcade" -gmregisiwin=true -gmchannelcode=110341560 -game.sku="5498298969203920516" -game.name="Delicious - Emily's Home Sweet Home" -gmregcopyvirtual=HKU\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\IplayArcade -gmreg="Software\IplayArcade" -gmexe="IplayGames.exe" -gmregkey="Install_Dir" -installer="C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\5498298969203920516.exe" -preinstallurl="http://gm-iplay.iwin.com/dl/preinstall-options.exe" -gamestring=5498298969203920516 -config.installRoot="c:\games\Iplay Games" -gmInstallRootRegKey="HKEY_CURRENT_USER\Software\iWinArcade\installRoot"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:640
        • C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe
          "C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe" -gamestring=5498298969203920516 /S
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:176
        • C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\5498298969203920516.exe
          "C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\5498298969203920516.exe" /S
          4⤵
          • Downloads MZ/PE file
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4732
          • C:\Users\Admin\AppData\Local\Temp\nstFCD6.tmp\iWinInstallOptions.exe
            "C:\Users\Admin\AppData\Local\Temp\nstFCD6.tmp\iWinInstallOptions.exe" /S
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2344
      • \??\c:\games\Iplay Games\Delicious - Emily's Home Sweet Home\GLWorker.exe
        "c:\games\Iplay Games\Delicious - Emily's Home Sweet Home\GLWorker.exe" ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid5498298969203920516
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Direct Volume Access: Opens a physical disk for reading
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4200
      • \??\c:\games\Iplay Games\Delicious - Emily's Home Sweet Home\GLWorker.exe
        "c:\games\Iplay Games\Delicious - Emily's Home Sweet Home\GLWorker.exe" ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid5498298969203920516
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Direct Volume Access: Opens a physical disk for reading
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2148
      • \??\c:\games\Iplay Games\Delicious - Emily's Home Sweet Home\GLWorker.exe
        "c:\games\Iplay Games\Delicious - Emily's Home Sweet Home\GLWorker.exe" ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid5498298969203920516
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Direct Volume Access: Opens a physical disk for reading
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:556
      • \??\c:\games\Iplay Games\Delicious - Emily's Home Sweet Home\GLWorker.exe
        "c:\games\Iplay Games\Delicious - Emily's Home Sweet Home\GLWorker.exe" ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid5498298969203920516
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Direct Volume Access: Opens a physical disk for reading
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:3680
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x4c0 0x490
    1⤵
      PID:4024
    • C:\Windows\system32\werfault.exe
      werfault.exe /hc /shared Global\e204a7ada1d9469b997dc8d79a9c1884 /t 3876 /p 3840
      1⤵
        PID:3228
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3708

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            iWinLauncher.exe
            • Path C:\Program Files (x86)\GMInstaller\iWinLauncher.exe
            • Size 771KB
            • SHA256 3dde4433e16f9ca97c8955b24a8a85162eb6ccca9d5a83931012d856fa714962
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            iWinUpgrader.exe
            • Path C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe
            • Size 1.5MB
            • SHA256 86cb79cb393ccbebd65e137cf509f09e0cabaecb93a2d21369488002712af118
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data_0
            • Path C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\data_0
            • Size 44KB
            • SHA256 7846185ea2e87eaca86ac2993c7719f88e153df24698c817c81f0f653455b56e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data_1
            • Path C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\data_1
            • Size 264KB
            • SHA256 76da93e6c55ca7c91712add3929f4661e5b1441f673666d0b0b267dd961b9b92
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data_2
            • Path C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\data_2
            • Size 1.0MB
            • SHA256 6231679484ef39923869e0e8bcb64cb5cf692492c6664d07c085c627d7da1df6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data_3
            • Path C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\data_3
            • Size 4.0MB
            • SHA256 84a18cb718dd5abedaa78003838110ab5639711df60758ad544646629a7d7bac
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            index
            • Path C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\index
            • Size 512KB
            • SHA256 b1352aba3db1c58290da5973ed46f8ca60f76c1cbfd796eadacd49d26d554ee2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Index
            • Path C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Index
            • Size 32KB
            • SHA256 f8d4497483155520b2c6b32c58c0df78a950fc2bb6975746a6ff7293f8625b24
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data_0
            • Path C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\Cache\data_0
            • Size 44KB
            • SHA256 bcd5059927bc0c62d038b329dd04df2ead32900f8d33251db4f9062d1939f1b0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data_1
            • Path C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\Cache\data_1
            • Size 264KB
            • SHA256 ca04e8eadf3a5c62ae6decaa7d0c69b8a1bddb8a9d1ad27bbbcfe31d96f891b7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data_2
            • Path C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\Cache\data_2
            • Size 1.0MB
            • SHA256 57b0b64eee8456ff91724052dcb227a398dd9dadf8e94e99025f559ccba1abde
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data_3
            • Path C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\Cache\data_3
            • Size 4.0MB
            • SHA256 07b4f2384259ebdb9e40346f553029738ef00ae01b0c008b93991c4b08eb6b95
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000017
            • Path C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\Cache\f_000017
            • Size 34KB
            • SHA256 ec3c93bfe9e44f4efda09a8aa2e49835140664872d5b4ed049c767613c819e60
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            index
            • Path C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\Cache\index
            • Size 512KB
            • SHA256 943e7bf26f7a0b91ab14ab695c056b5d4de956ee75fec2ab805a04efe2b92da2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            http_client.iplay.com_0.localstorage
            • Path C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\Local Storage\http_client.iplay.com_0.localstorage
            • Size 3KB
            • SHA256 5f589a84b3155c7c528d43a0d881fd695b61beb5aea4e7328a1e55a5c104d149
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            http_client.iplay.com_0.localstorage-journal
            • Path C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\Local Storage\http_client.iplay.com_0.localstorage-journal
            • Size 512B
            • SHA256 d66581fa450fed333f81b383c029b0dc703b4f86990e160d702de8e5a7e254a1
            • MD5 SHA1 SHA512
            Submit Download

            QuotaManager
            • Path C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\QuotaManager
            • Size 13KB
            • SHA256 4d67323befbd3fe3cecd1da79c032f8991931158424ffaf5ba45162163216f14
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Databases.db
            • Path C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\databases\Databases.db
            • Size 7KB
            • SHA256 a1deafb5bdcd6aef73c361ae2a9eef2cde62ed428abba63e801a8d6f7d2cbe33
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cdata.dat
            • Path C:\Users\Admin\AppData\Local\GamesManager\110500670\cdata.dat
            • Size 379KB
            • SHA256 db67ca3cf89a6fccd13aa21207e279c3fd3c7bcaf181c65ecfc18cf2da289eb3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000001
            • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000001
            • Size 248KB
            • SHA256 5e663896f40416a2d5f159e0433dbc9019dbe9d05abb34c1f3a5b38a88b5c03a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000002
            • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000002
            • Size 36KB
            • SHA256 49f14bad610f40f0ae76a33c55ef89a1e694219bab49b1b99cb53d754774c0fc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000003
            • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000003
            • Size 51KB
            • SHA256 4d191ea72953f5806161c3c16ae8e4bb629b47156481bd074acfa5db08000016
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000004
            • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000004
            • Size 242KB
            • SHA256 0a6c4c4db171663b9b1c533a4dd6938e22cb4d5b9607d0ca92a20c1354018b49
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000005
            • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000005
            • Size 58KB
            • SHA256 74d4acb9d62968980f8a096977e3bf42c1ccffb0c7501a7fff1a0ba589b56bd7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000006
            • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000006
            • Size 16KB
            • SHA256 b0b84f6aca649b3b9131799ed0983e03b113497df4f33e30a3389ee1b34687ee
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000007
            • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000007
            • Size 63KB
            • SHA256 2f49797d196f00bb331663ac1564c775d65ed1bfb508aec9e4c3b6fc89bb4dc0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000008
            • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000008
            • Size 21KB
            • SHA256 12d5f1be9a764164f4cc6e7dda726c4ea3d19ea79382d28c75b0dea862608968
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000009
            • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000009
            • Size 48KB
            • SHA256 209dc679252feca2725cafb6e8fc314f2618bd748db846be6b4e0ca71c55a330
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_00000a
            • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_00000a
            • Size 39KB
            • SHA256 3e05db9eae5443e2b629ae73496a7872602094fcf63d11eb5d99e63911c89d1e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_00000b
            • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_00000b
            • Size 151KB
            • SHA256 13bf19f7b084c49a6ef22dee10328411f4764e765209956bc1d01c8120cdacdb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_00000c
            • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_00000c
            • Size 66KB
            • SHA256 53c53364808c175a6038f9d0aae8fe3d1f5ce3cf87d5e9fa08f603d845633b37
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_00000d
            • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_00000d
            • Size 77KB
            • SHA256 de5c4e5ba7b850bbe5d35de5b20f4fd875be1f77ef73f7431172d1e0f6496dc6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_00000e
            • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_00000e
            • Size 39KB
            • SHA256 cd299b9251186ebf3bb0e928e4f710b3b542f0cde01bea6832cbada49138a85d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_00000f
            • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_00000f
            • Size 46KB
            • SHA256 a6db907a7ac399d7e920de4ac4b4a92808542039ba32dc6758637bffb413d56d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000010
            • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000010
            • Size 246KB
            • SHA256 1717ea1fde8ceb7584341a24efc85c853083c660a1185968fbf94520f7193de2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000011
            • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000011
            • Size 25KB
            • SHA256 379bc709031d0e429a41012efd921210bcfd409ecaabe35257a3716032eb99a3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000012
            • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000012
            • Size 82KB
            • SHA256 6c5c0a29044c5aeec37211b18908acd0576b9dabc9d6fe95c8066cdc55146c0f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000013
            • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000013
            • Size 581KB
            • SHA256 295eac26825508b5f37f27c69b99d426582fe80752f636c69f1795be8f5d5ea4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000014
            • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000014
            • Size 160KB
            • SHA256 74cd4d1f792e1200fd426048b53970c4eaeb5e5c1c789d034bffdff68167b3be
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000015
            • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000015
            • Size 238KB
            • SHA256 7f6a44eb7632c2cb6f990ede10a58c2cc3fb923bae1761f1be8e2a9ea3847b78
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000016
            • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000016
            • Size 620KB
            • SHA256 f148af9bffe215b1396117bb04aeb9f35fc82f346999a767a363198e9878ceae
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            microsoft.windows[1].xml
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\T0YVTMWS\microsoft.windows[1].xml
            • Size 97B
            • SHA256 0a3882b40ace02096c82c3d31cd00544f2a1c3bb5dd37bfc693c2067137fb838
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            AppCache134364232540185738.txt.~tmp
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134364232540185738.txt.~tmp
            • Size 87KB
            • SHA256 e3d21f531b8147307b06c097d71a7fba72abb36fc438f33b33cd9891b6fceb0e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            drmworker5498298969203920516
            • Path C:\Users\Admin\AppData\Local\Temp\GameManager\DRMWorker\drmworker5498298969203920516
            • Size 80B
            • SHA256 ce63d5ef4d33d5f98e0e81f596c02e9f219d05e044f9dd0a2cba46467e282095
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StdUtils.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nseA8BF.tmp\StdUtils.dll
            • Size 26KB
            • SHA256 c169393e49723cfdcdcbcf80e062be9e841539f90e4b7b85b482212715a1f7c6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsProcess.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nseA8BF.tmp\nsProcess.dll
            • Size 4KB
            • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsyFC0B.tmp\System.dll
            • Size 10KB
            • SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            NSISdl.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsz8374.tmp\NSISdl.dll
            • Size 14KB
            • SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsz8374.tmp\System.dll
            • Size 11KB
            • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nszCE69.tmp\System.dll
            • Size 11KB
            • SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            preinstall-options.exe
            • Path C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe
            • Size 77KB
            • SHA256 626953268197dacf5491197a3c4c60b4f2a14c3e878efb640eb48f34c9b23e31
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/556-1452-0x0000000000400000-0x000000000060C000-memory.dmp
            Download

            memory/1776-914-0x0000000000780000-0x0000000000792000-memory.dmp
            Download

            memory/2148-1424-0x0000000000400000-0x000000000060C000-memory.dmp
            Download

            memory/2148-1420-0x00000000027D0000-0x00000000029DC000-memory.dmp
            Download

            memory/2148-1416-0x00000000027D0000-0x00000000029DC000-memory.dmp
            Download

            memory/2148-1426-0x0000000000400000-0x000000000060C000-memory.dmp
            Download

            memory/2148-1433-0x0000000000400000-0x000000000060C000-memory.dmp
            Download

            memory/3416-1080-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1103-0x0000000072120000-0x0000000072153000-memory.dmp
            Download

            memory/3416-1084-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1079-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1078-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1077-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1075-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1074-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1073-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1071-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1070-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1069-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1067-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1066-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1064-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1063-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1061-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1060-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1059-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1058-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1057-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1056-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1055-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1053-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1081-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1076-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1072-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1068-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1065-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1062-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1054-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1083-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1102-0x0000000072AD0000-0x0000000072AF7000-memory.dmp
            Download

            memory/3416-1101-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1104-0x0000000002960000-0x0000000002961000-memory.dmp
            Download

            memory/3416-1138-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1140-0x0000000072120000-0x0000000072153000-memory.dmp
            Download

            memory/3416-1139-0x0000000072AD0000-0x0000000072AF7000-memory.dmp
            Download

            memory/3416-1048-0x0000000000A50000-0x0000000000A62000-memory.dmp
            Download

            memory/3416-1082-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1093-0x0000000072120000-0x0000000072153000-memory.dmp
            Download

            memory/3416-1085-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1086-0x0000000072160000-0x0000000072312000-memory.dmp
            Download

            memory/3416-1087-0x0000000072120000-0x0000000072153000-memory.dmp
            Download

            memory/3416-1092-0x0000000072120000-0x0000000072153000-memory.dmp
            Download

            memory/3416-1091-0x0000000072120000-0x0000000072153000-memory.dmp
            Download

            memory/3416-1090-0x0000000072120000-0x0000000072153000-memory.dmp
            Download

            memory/3416-1089-0x0000000072120000-0x0000000072153000-memory.dmp
            Download

            memory/3416-1088-0x0000000072120000-0x0000000072153000-memory.dmp
            Download

            memory/3680-1471-0x0000000000400000-0x000000000060C000-memory.dmp
            Download

            memory/3708-1216-0x000001B264AC0000-0x000001B264AE0000-memory.dmp
            Download

            memory/3708-1179-0x000001B264690000-0x000001B2646B0000-memory.dmp
            Download

            memory/3708-1215-0x000001B264960000-0x000001B264980000-memory.dmp
            Download

            memory/4200-1414-0x0000000000400000-0x000000000060C000-memory.dmp
            Download

            memory/4200-1404-0x0000000000400000-0x000000000060C000-memory.dmp
            Download

            memory/4200-1401-0x00000000029B0000-0x0000000002BBC000-memory.dmp
            Download

            memory/4200-1397-0x00000000029B0000-0x0000000002BBC000-memory.dmp
            Download

            memory/4200-1395-0x0000000000400000-0x000000000060C000-memory.dmp
            Download

            memory/4200-1407-0x00000000029B0000-0x0000000002BBC000-memory.dmp
            Download

            memory/4200-1406-0x0000000000400000-0x000000000060C000-memory.dmp
            Download

            memory/4200-1405-0x0000000000400000-0x000000000060C000-memory.dmp
            Download

            memory/4200-1409-0x00000000029B0000-0x0000000002BBC000-memory.dmp
            Download