Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1522706
MD5: 07df7ce090a7fe033952ef5651684566
SHA1: fa0b5c800577df34320a8289d1a8ab50eb4659bb
SHA256: 37c2b040bf4aad7189adcd32f1021208622754c043d6e3f8b4afa5dc9f078ee0
Tags: exeuser-jstrosch
Infos:

Detection

Score: 57
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Compliance

Score: 34
Range: 0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Machine Learning detection for sample
Tries to harvest and steal browser information (history, passwords, etc)
Windows shortcut file (LNK) contains suspicious command line arguments
Adds / modifies Windows certificates
Binary contains a suspicious time stamp
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
EXE planting / hijacking vulnerabilities found
Enables security privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Installs a raw input device (often for capturing keystrokes)
Internet Provider seen in connection with other malware
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sleep loop found (likely to delay execution)
Stores large binary data to the registry
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 23%
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAj/u/XDdjlDyw7gHEtaaasZ9GdG8WOKAyJzXd8HFrDtz2Jcuy7er7MtWvHgNDA0bwpznbI5YdZeV4UfCEsA4SrA5b3MnWTHwA1bgbiDM+L9rrqvcadcKuOlTeN48Q0ijmhHlNFbTzvT9W0zw/GKv8LgXAHggxtmHQ/Z9PP2QNF5O8rUHHSL4AJ6hNcEKSBVSmbbjeVm4gSXDuED5r0nwxvRtupDxGYp8IZpP5KlExqNu1nbkPc+igCTIB6XsqijagzxewUHCdovmkb2JNtskx/PMIEv+TvWIx2BzqGp71gSh/dV7SJ3rClvWd2xj8dtxG8FfAWDTIIi0qZXWn2QhizQIDAQAB-----END PUBLIC KEY----- memstr_3cfb61ff-d
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe EXE: C:\Users\user\AppData\Roaming\MSN Games Notifier\installer.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe EXE: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\Uninstaller.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe EXE: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\iWinUpgrader.exe Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe EXE: C:\Users\user\AppData\Local\Programs\MSN-Games-Notifier\MSN Games Notifier.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe EXE: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe EXE: C:\Users\user\AppData\Local\Programs\MSN-Games-Notifier\Uninstall MSN Games Notifier.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe EXE: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\iWinInstaller.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe EXE: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\Firewall.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe EXE: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\iWinPrerequisitesAdmin.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe EXE: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\browser_cef_exe.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe EXE: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\iWinLauncher.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe EXE: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\iWinPrerequisitesUser.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe EXE: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Jump to behavior

Compliance
barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe EXE: C:\Users\user\AppData\Roaming\MSN Games Notifier\installer.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe EXE: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\Uninstaller.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe EXE: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\iWinUpgrader.exe Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe EXE: C:\Users\user\AppData\Local\Programs\MSN-Games-Notifier\MSN Games Notifier.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe EXE: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe EXE: C:\Users\user\AppData\Local\Programs\MSN-Games-Notifier\Uninstall MSN Games Notifier.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe EXE: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\iWinInstaller.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe EXE: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\Firewall.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe EXE: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\iWinPrerequisitesAdmin.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe EXE: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\browser_cef_exe.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe EXE: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\iWinLauncher.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe EXE: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\iWinPrerequisitesUser.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe EXE: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Jump to behavior
Uses 32bit PE files
Source: file.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MSN Games Manager Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\Temp\gm_installation_inner.log Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe File created: C:\Users\user\AppData\Local\Programs\MSN-Games-Notifier\LICENSE.electron.txt Jump to behavior
Source: file.exe Static PE information: certificate valid
Source: Binary string: fkadialhk.dllacpiz.dllactivedetect32.dllactivedetect64.dllairfoilinject3.dllakinsofthook32.dllassistant_x64.dllavcuf64.dllavgrsstx.dllbabylonchromepi.dllbtkeyind.dllcmcsyshk.dllcmsetac.dllcooliris.dllcplushook.dlldockshellhook.dlleasyhook32.dllesspd.dllgoogledesktopnetwork3.dllfwhook.dllguard64.dllhookprocesscreation.dllhookterminateapis.dllhookprintapis.dllimon.dllicatcdll.dllicdcnl.dllioloHL.dllkloehk.dlllawenforcer.dlllibdivx.dlllvprcinj01.dllmadchook.dllmdnsnsp.dllmoonsysh.dllmpk.dllnpdivx32.dllnpggNT.desnpggNT.dlloawatch.dllpastali32.dllpavhook.dllpavlsphook.dllpavshook.dllpavshookwow.dllpctavhook.dllpctgmhk.dllpicrmi32.dllpicrmi64.dllprntrack.dllprotector.dllradhslib.dllradprlib.dllrapportnikko.dllrlhook.dllrooksdol.dllrndlpepperbrowserrecordhelper.dllrpchromebrowserrecordhelper.dllr3hook.dllsahook.dllsbrige.dllsc2hook.dllsdhook32.dllsguard.dllsmum32.dllsmumhook.dllssldivx.dllsyncor11.dllsystools.dlltfwah.dllwblind.dllwbhelp.dllwindowsapihookdll32.dllwindowsapihookdll64.dllwinstylerthemehelper.dll\*::OpenProcessToken(::GetCurrentProcess(), TOKEN_QUERY, &token)../../content/common/sandbox_win.cc::GetTokenInformation(token, TokenSessionId, &session_id, sizeof(session_id), &session_id_length)\Sessions\%lu%lsProcess.Sandbox.FlagOverrodeRemoteSessionCheck\??\pipe\chrome.*\\.\pipe\chrome.nacl.*\\.\pipe\chrome.sync.**.pdbProcess.Sandbox.Launch.WarningResultCodeProcess.Sandbox.Launch.Warning\Device\DeviceApiFileYou are attempting to duplicate a privileged handle into a sandboxed process. source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: D:\Jenkins\workspace\client3.exe.iwininstaller\ugmtooliwininstallerexe\bin\exe\iWinInstaller.pdb source: GamesManager.exe, 00000007.00000003.3293582074.0000000002E06000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: XInput1_3.pdb source: toasterinstaller.exe, 00000006.00000003.3242267684.0000000003670000.00000004.00001000.00020000.00000000.sdmp, toasterinstaller.exe, 00000006.00000003.3242095039.00000000034B0000.00000004.00001000.00020000.00000000.sdmp, toasterinstaller.exe, 00000006.00000003.3242309069.0000000002EE0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Jenkins\workspace\client3.exe.iwinlauncher\ugmtooliwinlauncherexe\bin\exe\iWinLauncher.pdb source: GamesManager.exe, 00000007.00000003.3293772599.00000000032C1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: XInput1_3.pdb@ source: toasterinstaller.exe, 00000006.00000003.3242267684.0000000003670000.00000004.00001000.00020000.00000000.sdmp, toasterinstaller.exe, 00000006.00000003.3242095039.00000000034B0000.00000004.00001000.00020000.00000000.sdmp, toasterinstaller.exe, 00000006.00000003.3242309069.0000000002EE0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Jenkins\workspace\client3.exe.unifiedgamesmanager\ugmexe\bin\exe\UnifiedGamesManager.pdb source: GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: D:\Jenkins\workspace\client3.exe.iwinprerequisites\ugmtoolprerequisites\bin\exe\iWinPrerequisitesAdmin.pdb source: GamesManager.exe, 00000007.00000003.3293940425.00000000032C1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Jenkins\workspace\client3.exe.iwininstaller\ugmtooliwininstallerexe\bin\exe\iWinInstaller.pdb7 source: GamesManager.exe, 00000007.00000003.3293582074.0000000002E06000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Jenkins\workspace\client3.exe.iwinprerequisites\ugmtoolprerequisites\bin\exe\iWinPrerequisitesUser.pdb source: GamesManager.exe, 00000007.00000002.3458594645.00000000032D0000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00405302 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 0_2_00405302
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00405CD8 FindFirstFileA,FindClose, 0_2_00405CD8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0040263E FindFirstFileA, 0_2_0040263E
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Code function: 4_2_00406301 FindFirstFileW,FindClose, 4_2_00406301
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Code function: 4_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 4_2_00406CC7
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Code function: 5_2_00402E18 FindFirstFileW, 5_2_00402E18
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Code function: 5_2_00406436 FindFirstFileW,FindClose, 5_2_00406436
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Code function: 5_2_00406DFC DeleteFileW,CloseHandle,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 5_2_00406DFC
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Code function: 6_2_0040287E FindFirstFileW, 6_2_0040287E
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Code function: 6_2_00406427 FindFirstFileW,FindClose, 6_2_00406427
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Code function: 6_2_004058D5 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 6_2_004058D5
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE97409 FindFirstFileExA, 7_2_6CE97409
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File opened: C:\Users\user\Documents\desktop.ini Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File opened: C:\Users\user\AppData\Local\Temp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File opened: C:\Users\user\AppData\Local Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File opened: C:\Users\user\Desktop\desktop.ini Jump to behavior

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2833314 - Severity 1 - ETPRO MALWARE Win32/Agent.QP Requesting Payload : 192.168.2.5:49730 -> 18.245.31.40:80
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AMAZON-02US AMAZON-02US
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: HEAD / HTTP/1.1Host: ugm3-msn.iwin.comConnection: keep-aliveOrigin: http://gmUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept: */*Referer: http://gm/splash.html?launchurl=https://ugm3-msn.iwin.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: ugm3-msn.iwin.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8
Source: global traffic HTTP traffic detected: GET /ugm.appcache HTTP/1.1Host: ugm3-msn.iwin.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8Cookie: ugm3device=ugm
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: ugm3-msn.iwin.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8Cookie: ugm3device=ugm
Source: global traffic HTTP traffic detected: GET /assets/ugm3-msn_iwin_com/offline-94e0c02b76a422b1c94ca5ad97c852ca577079edb6bd6688e5d1bf3042facd22.js HTTP/1.1Host: play.iwincdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: ugm3-msn.iwin.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8Cookie: ugm3device=ugm
Source: global traffic HTTP traffic detected: GET /offline HTTP/1.1Host: ugm3-msn.iwin.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8Cookie: ugm3device=ugm
Source: global traffic HTTP traffic detected: GET /assets/site/ajax-loader-2-62916463ab77e7f2aea4f13eee7b21c1801a6997cd15f90dd18135539bbc414d.gif HTTP/1.1Host: play.iwincdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8
Source: global traffic HTTP traffic detected: GET /assets/ugm3-msn_iwin_com/logo-loading-c6983a12a93990ab7e6d5224d41eea343f5188fdb4649e36bb1c2a43b0e8b5d9.png HTTP/1.1Host: play.iwincdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept: image/webp,image/apng,image/*,*/*;q=0.8Referer: https://ugm3-msn.iwin.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8
Source: global traffic HTTP traffic detected: GET /assets/ugm3-msn_iwin_com/loading-c7c643216b5fbb8e3554c4377ac2fa5f8b4decf15d1569ef8362be8d3bd1cca1.js HTTP/1.1Host: play.iwincdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8
Source: global traffic HTTP traffic detected: GET /assets/site/ajax-loader-443ab5e1c534732de9740651feb46b329eb7ae230636a80d0d9c075e502a5dbc.gif HTTP/1.1Host: play.iwincdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8
Source: global traffic HTTP traffic detected: GET /assets/site/moredata-79398f1ef11de2f4203c85014a39f1c1a8b74ef95a704568a49324a5c2d3342d.gif HTTP/1.1Host: play.iwincdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8
Source: global traffic HTTP traffic detected: GET /assets/site/no-internet-1f884dafc618d40d55fd8ce1b9d2154e22339ef1c67669c782b294094da7235e.png HTTP/1.1Host: play.iwincdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: ugm3-msn.iwin.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8
Source: global traffic HTTP traffic detected: GET /ugm.appcache HTTP/1.1Host: ugm3-msn.iwin.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8Cookie: ugm3device=ugm
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: ugm3-msn.iwin.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8Cookie: ugm3device=ugm
Source: global traffic HTTP traffic detected: GET /assets/ugm3-msn_iwin_com/offline-94e0c02b76a422b1c94ca5ad97c852ca577079edb6bd6688e5d1bf3042facd22.js HTTP/1.1Host: play.iwincdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: ugm3-msn.iwin.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8Cookie: ugm3device=ugm
Source: global traffic HTTP traffic detected: GET /offline HTTP/1.1Host: ugm3-msn.iwin.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8Cookie: ugm3device=ugm
Source: global traffic HTTP traffic detected: GET /assets/site/ajax-loader-2-62916463ab77e7f2aea4f13eee7b21c1801a6997cd15f90dd18135539bbc414d.gif HTTP/1.1Host: play.iwincdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8
Source: global traffic HTTP traffic detected: GET /assets/ugm3-msn_iwin_com/logo-loading-c6983a12a93990ab7e6d5224d41eea343f5188fdb4649e36bb1c2a43b0e8b5d9.png HTTP/1.1Host: play.iwincdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept: image/webp,image/apng,image/*,*/*;q=0.8Referer: https://ugm3-msn.iwin.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8
Source: global traffic HTTP traffic detected: GET /assets/ugm3-msn_iwin_com/loading-c7c643216b5fbb8e3554c4377ac2fa5f8b4decf15d1569ef8362be8d3bd1cca1.js HTTP/1.1Host: play.iwincdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8
Source: global traffic HTTP traffic detected: GET /assets/site/ajax-loader-443ab5e1c534732de9740651feb46b329eb7ae230636a80d0d9c075e502a5dbc.gif HTTP/1.1Host: play.iwincdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8
Source: global traffic HTTP traffic detected: GET /assets/site/moredata-79398f1ef11de2f4203c85014a39f1c1a8b74ef95a704568a49324a5c2d3342d.gif HTTP/1.1Host: play.iwincdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8
Source: global traffic HTTP traffic detected: GET /assets/site/no-internet-1f884dafc618d40d55fd8ce1b9d2154e22339ef1c67669c782b294094da7235e.png HTTP/1.1Host: play.iwincdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPIAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8
Source: global traffic HTTP traffic detected: GET /gm/live/UgmMsnInstaller.exe HTTP/1.0Host: p.iwin.comUser-Agent: NSISDL/1.2 (Mozilla)Accept: */*
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: "url": "https://www.facebook.com/chat/video/videocalldownload.php", equals www.facebook.com (Facebook)
Source: GamesManager.exe, 00000007.00000002.3461793997.0000000004465000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: var url = 'http://www.youtube.com/embed/' + equals www.youtube.com (Youtube)
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: !walla.co.ilhttp://www.walla.co.il/favicon.icohttp://search.walla.co.il/?q={searchTerms}Yahoo! Hong Konghk.yahoo.comhttps://hk.search.yahoo.com/favicon.icohttps://hk.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}https://hk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms}in.grhttp://find.in.gr/Themes/1/Default/Media/Layout/icon_in.pnghttp://find.in.gr/?q={searchTerms}&ie={inputEncoding}&cx=partner-pub-3451081775397713%3Aklnvxp4nycj&cof=FORID%3A9 equals www.yahoo.com (Yahoo)
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: ^baidu.comhttps://www.baidu.com/favicon.icohttps://www.baidu.com/#ie={inputEncoding}&wd={searchTerms}http://suggestion.baidu.com/su?wd={searchTerms}&action=opensearch&ie={inputEncoding}Yahoo! Schweizch.yahoo.comhttps://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms}Najdi.sinajdi.sihttps://www.najdi.si/assets/PROD-1.5.16/ctx/images/favicon.icohttps://www.najdi.si/search.jsp?q={searchTerms}Yahoo! Colombiaco.yahoo.comhttps://co.search.yahoo.com/favicon.icohttps://co.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}https://co.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms}Yahoo! Chilecl.yahoo.comhttps://cl.search.yahoo.com/favicon.icohttps://cl.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}https://cl.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms}Yahoo! Canadaca.yahoo.comhttps://ca.search.yahoo.com/favicon.icohttps://ca.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}https://ca.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms}SweetIMhome.sweetim.comhttp://search.sweetim.com/favicon.icohttp://search.sweetim.com/search.asp?q={searchTerms}&ln={language}Yahoo! Rom equals www.yahoo.com (Yahoo)
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: gr.yahoo.comhttps://gr.search.yahoo.com/favicon.icohttps://gr.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}yandex.ruhttps://yandex.ru/{yandex:searchPath}?text={searchTerms}&{yandex:referralID}https://suggest.yandex.ru/suggest-ff.cgi?part={searchTerms}https://yandex.ru/images/search/?rpt=imageviewhttps://www.yandex.ru/chrome/newtab$ equals www.yahoo.com (Yahoo)
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: hkhttp://search.conduit.com/Results.aspx?q={searchTerms}Conduitconduit.comhttp://www.conduit.com/favicon.icohttp://www.conduit.com/search?q={searchTerms}&ie={inputEncoding}&cx=010301873083402539744%3Anxaq5wgrtuo&cof=forid%3A11Yahoo! Venezuelave.yahoo.comhttps://ve.search.yahoo.com/favicon.icohttps://ve.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}https://ve.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms}Kvasirkvasir.nohttps://kvasir.no/grafikk/favicon.icohttps://kvasir.no/alle?q={searchTerms}Yahoo!yahoo.comhttps://search.yahoo.com/favicon.icohttps://search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms}Yahoo! Vi equals www.yahoo.com (Yahoo)
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: hkhttp://www.search-results.com/web?q={searchTerms}Search-resultssearch-results.comhttp://ak.apnstatic.com/media/images/favicon_search-results.icohttp://dts.search-results.com/sr?lng={language}&src=hmp&q={searchTerms}Yahoo! Singaporesg.yahoo.comhttps://sg.search.yahoo.com/favicon.icohttps://sg.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}https://sg.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms}searchnusearchnu.comhttp://www.searchnu.com/favicon.icohttp://www.searchnu.com/web?hl={language}&si={searchTerms} equals www.yahoo.com (Yahoo)
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: naver.comhttps://ssl.pstatic.net/sstatic/search/favicon/favicon_140327.icohttps://search.naver.com/search.naver?ie={inputEncoding}&query={searchTerms}&sm=chr_htyhttps://ac.search.naver.com/nx/ac?of=os&ie={inputEncoding}&q={searchTerms}&oe={outputEncoding}yandex.kzhttps://yandex.kz/{yandex:searchPath}?text={searchTerms}https://suggest.yandex.kz/suggest-ff.cgi?part={searchTerms}https://yandex.kz/images/search/?rpt=imageviewhttps://www.yandex.kz/chrome/newtabbATLAS.SKatlas.skhttp://static.mediacentrum.sk/katalog/atlas.sk/images/favicon.icohttp://hladaj.atlas.sk/fulltext/?phrase={searchTerms}UTF-8Yahoo! UK & Irelanduk.yahoo.comhttps://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms}Yahoo! JAPANyahoo.co.jphttps://search.yahoo.co.jp/favicon.icohttps://search.yahoo.co.jp/search?ei={inputEncoding}&fr=crmas&p={searchTerms}https://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?p={searchTerms}&appid=oQsoxcyxg66enp0TYoirkKoryq6rF8bK76mW0KYxZ0v0WPLtn.Lix6wy8F_LwGWHUII-&output=fxjson&fr=crmas equals www.yahoo.com (Yahoo)
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: niaro.yahoo.comhttps://ro.search.yahoo.com/favicon.icohttps://ro.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}Onet.plonet.plhttp://szukaj.onet.pl/favicon.icohttp://szukaj.onet.pl/wyniki.html?qt={searchTerms}Zoznamzoznam.skhttp://www.zoznam.sk/favicon.icohttp://www.zoznam.sk/hladaj.fcgi?s={searchTerms}windows-1250@MAIL.RUmail.ruhttps://go.imgsmail.ru/favicon.icohttps://go.mail.ru/search?q={searchTerms}windows-1251https://suggests.go.mail.ru/chrome?q={searchTerms}H equals www.yahoo.com (Yahoo)
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: nigma.ruhttp://nigma.ru/themes/nigma/img/favicon.icohttp://nigma.ru/?s={searchTerms}http://autocomplete.nigma.ru/complete/query_help.php?suggest=true&q={searchTerms}Yahoo! Suomifi.yahoo.comhttps://fi.search.yahoo.com/favicon.icohttps://fi.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}yandex.byhttps://yandex.by/{yandex:searchPath}?text={searchTerms}https://suggest.yandex.by/suggest-ff.cgi?part={searchTerms}https://yandex.by/images/search/?rpt=imageviewhttps://www.yandex.by/chrome/newtab equals www.yahoo.com (Yahoo)
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: pe.yahoo.comhttps://pe.search.yahoo.com/favicon.icohttps://pe.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}https://pe.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms}Virgiliovirgilio.ithttp://ricerca.virgilio.it/common/favicon.icohttp://ricerca.virgilio.it/ricerca?qs={searchTerms}AOLaol.comhttps://search.aol.com/favicon.icohttps://search.aol.com/aol/search?q={searchTerms}http://autocomplete.search.aol.com/autocomplete/get?output=json&it=&q={searchTerms}DELFIdelfi.lvhttp://g1.delphi.lv/favicon.icohttp://www.delfi.lv/search_all/?ie={inputEncoding}&q={searchTerms}&lang={language}&cx=partner-pub-7754285690273419%3A1507605038&cof=FORID%3A10delfi.lthttp://www.delfi.lt/favicon.icohttp://www.delfi.lt/paieska/?q={searchTerms}Yahoo! Indiain.yahoo.comhttps://in.search.yahoo.com/favicon.icohttps://in.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}https://in.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms}Yahoo! Indonesiaid.yahoo.comhttps://id.search.yahoo.com/favicon.icohttps://id.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}https://id.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms}Yahoo! equals www.yahoo.com (Yahoo)
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: rkiyetr.yahoo.comhttps://tr.search.yahoo.com/favicon.icohttps://tr.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}Yahoo! Philippinesph.yahoo.comhttps://ph.search.yahoo.com/favicon.icohttps://ph.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}https://ph.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms}Yahoo!GYidtw.yahoo.comhttps://tw.search.yahoo.com/favicon.icohttps://tw.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}https://tw.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms}Atlas.czatlas.czhttp://searchatlas.centrum.cz/favicon.icohttp://searchatlas.centrum.cz/?q={searchTerms}http://radce.centrum.cz/?q={searchTerms}&of=1OK.huok.huhttp://ok.hu/gfx/favicon.icohttp://ok.hu/katalogus?q={searchTerms}ISO-8859-2Yandexyandex.com.trhttps://yastatic.net/lego/_/rBTjd6UOPk5913OSn5ZQVYMTQWQ.icohttps://www.yandex.com.tr/{yandex:searchPath}?text={searchTerms}https://suggest.yandex.com.tr/suggest-ff.cgi?part={searchTerms}https://yandex.com.tr/gorsel/search?rpt=imageviewhttps://www.yandex.com.tr/chrome/newtabYahoo! Espa equals www.yahoo.com (Yahoo)
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: sterreichat.yahoo.comhttps://at.search.yahoo.com/favicon.icohttps://at.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}https://at.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms}Yahoo!7au.yahoo.comhttps://au.search.yahoo.com/favicon.icohttps://au.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}https://au.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms}Yahoo! Argentinaar.yahoo.comhttps://ar.search.yahoo.com/favicon.icohttps://ar.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}https://ar.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms}Bingbing.comhttps://www.bing.com/s/a/bing_p.icohttps://www.bing.com/search?q={searchTerms}&PC=U316&FORM=CHROMNhttps://www.bing.com/osjson.aspx?query={searchTerms}&language={language}&PC=U316https://www.bing.com/images/detail/search?iss=sbi&FORM=CHROMI#enterInsightshttps://www.bing.com/chrome/newtabimgurl={google:imageURL}360so.comhttps://www.so.com/favicon.icohttps://www.so.com/s?ie={inputEncoding}&q={searchTerms}https://sug.so.360.cn/suggest?encodein={inputEncoding}&encodeout={outputEncoding}&format=opensearch&word={searchTerms}$ equals www.yahoo.com (Yahoo)
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: th.yahoo.comhttps://th.search.yahoo.com/favicon.icohttps://th.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}https://th.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms}TUT.BYtut.byhttp://search.tut.by/favicon.icohttp://search.tut.by/?ru=1&query={searchTerms}http://suggest.yandex.ru/suggest-ff.cgi?part={searchTerms}&limit=10Vinden.nlvinden.nlhttps://www.vinden.nl/favicon.icohttps://www.vinden.nl/?q={searchTerms}Wirtualna Polskawp.plhttp://i.wp.pl/a/i/stg/500/favicon.icohttp://szukaj.wp.pl/szukaj.html?q={searchTerms}Askask.comhttp://sp.ask.com/sh/i/a16/favicon/favicon.icohttp://www.ask.com/web?q={searchTerms}http://ss.ask.com/query?q={searchTerms}&li=ffYahoo! T equals www.yahoo.com (Yahoo)
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: yandex.uahttps://yastatic.net/lego/_/pDu9OWAQKB0s2J9IojKpiS_Eho.icohttps://yandex.ua/{yandex:searchPath}?text={searchTerms}https://suggest.yandex.ua/suggest-ff.cgi?part={searchTerms}https://yandex.ua/images/search/?rpt=imageviewhttps://www.yandex.ua/chrome/newtabhttps://storage.ape.yandex.net/get/browser/Doodles/yandex/drawable-xxhdpi/yandex.pngupfile={google:imageThumbnail},original_width={google:imageOriginalWidth},original_height={google:imageOriginalHeight},prg=1Yahoo! Deutschlandde.yahoo.comhttps://de.search.yahoo.com/favicon.icohttps://de.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}https://de.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms}Yahoo! equals www.yahoo.com (Yahoo)
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: |j.gmailcalendar.google.com.calendarwww.youtube.com.youtube.top10sina.com.cnfacebook.combaidu.comqq.comtwitter.comtaobao.comlive.comyahooamazonwikipediaRenderThreadImpl::InitInitializeCompositorThreadScheduleIdleHandlerGetGpuFactories!base::CommandLine::ForCurrentProcess()->HasSwitch( switches::kSingleProcess)_IpcMessageHandlerClass::OnCreateNewSharedWorker5minOnProcessBackgrounded10min15min30minOnProcessPurgeAndSuspend60min90minMemory.Experimental.Renderer.PartitionAlloc.AfterBackgroundedMemory.Experimental.Renderer.BlinkGC.AfterBackgroundedMemory.Experimental.Renderer.Malloc.AfterBackgroundedMemory.Experimental.Renderer.Discardable.AfterBackgroundedMemory.Experimental.Renderer.V8MainThreaIsolate.AfterBackgroundedMemory.Experimental.Renderer.TotalAllocated.AfterBackgroundedPurgeAndSuspend.Experimental.MemoryGrowth.PartitionAllocKBPurgeAndSuspend.Experimental.MemoryGrowth.BlinkGCKBPurgeAndSuspend.Experimental.MemoryGrowth.MallocKBPurgeAndSuspend.Experimental.MemoryGrowth.DiscardableKBPurgeAndSuspend.Experimental.MemoryGrowth.V8MainThreadIsolateKBPurgeAndSuspend.Experimental.MemoryGrowth.TotalAllocatedKBRenderThreadImpl::EstablishGpuChannelSyncNQE.RenderThreadNotifiedRenderThreadImpl::OnMemoryPressureMemory.Experimental.Renderer.PurgedMemoryRenderer::FILE equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: p.iwin.com
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://.css
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://.jpg
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://EVSecure-crl.geotrust.com/GeoTrustPCA.crl0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://EVSecure-ocsp.geotrust.com0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://aia.startssl.com/certs/ca.crt0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://aia.startssl.com/certs/ca.crt02
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://aia1.wosign.com/ca1-class3-server.cer0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://aia1.wosign.com/ca1g2-server3.cer0
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: file.exe, 00000000.00000003.2743256931.0000000000739000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000002.3450054193.0000000000420000.00000004.00000001.01000000.00000008.sdmp, GamesManagerInstaller.exe, 00000005.00000002.3453979856.000000000041F000.00000004.00000001.01000000.0000000B.sdmp, GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3293772599.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3293940425.0000000003312000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: file.exe, 00000000.00000003.2743256931.0000000000739000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000002.3450054193.0000000000420000.00000004.00000001.01000000.00000008.sdmp, GamesManagerInstaller.exe, 00000005.00000002.3453979856.000000000041F000.00000004.00000001.01000000.0000000B.sdmp, GamesManager.exe, 00000007.00000003.3293772599.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3457869406.0000000003119000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3293940425.0000000003312000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://certificates.godaddy.com/repository/gd_intermediate.crt0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://certificates.godaddy.com/repository100.
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://certs.godaddy.com/repository/1301
Source: GamesManager.exe, 00000007.00000003.3292239522.0000000003224000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3292272728.0000000003232000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://certs.oati.net/repository/OATICA2.crl0
Source: GamesManager.exe, 00000007.00000003.3292239522.0000000003224000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3292272728.0000000003232000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://certs.oati.net/repository/OATICA2.crt0
Source: GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://certs.oati.net/repository/OATICA2.crt01
Source: GamesManager.exe, 00000007.00000003.3292239522.0000000003224000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3292272728.0000000003232000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crl
Source: GamesManager.exe, 00000007.00000003.3292239522.0000000003224000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3292272728.0000000003232000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crt08
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://certs.starfieldtech.com/repository/1402
Source: GamesManager.exe, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp String found in binary or memory: http://client.iplay.com/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://clients3.google.com/cert_upload_json
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://clients3.google.com/cert_upload_jsonT
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: http://code.google.com/codesearch#OAMlx_jo-ck/src/content/public/
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: http://code.google.com/p/chromium/issues/detail?id=125863)
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp, GamesManager.exe, 00000007.00000002.3455600278.0000000000F10000.00000002.00000001.00040000.0000001E.sdmp String found in binary or memory: http://code.google.com/p/chromium/issues/entry
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: GamesManager.exe, 00000007.00000003.3292239522.0000000003224000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cps.siths.se/sithsrootcav1.html0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crbug.com
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: http://crbug.com/360567
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: http://crbug.com/469522
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crbug.comit.value().GetAsDictionary(&dict)../../components/policy/core/common/schema.ccSchema
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.certum.pl/ca.crl0h
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0;
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.entrust.net/g2ca.crl0;
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.entrust.net/rootca1.crl0;
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.geotrust.com/GeoTrustPCA-G3.crl0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.geotrust.com/crls/gtglobal.crl04
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.geotrust.com/crls/secureca.crl0F
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.geotrust.com/crls/secureca.crl0N
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.globalsign.com/root.crl0V
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.globalsign.net/root.crl0=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.godaddy.com/gdroot-g2.crl0F
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.godaddy.com/gdroot.crl0F
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.godaddy.com/gds1-20
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.rootg2.amazontrust.com/rootg2.crl0
Source: file.exe, 00000000.00000003.2743256931.0000000000739000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000002.3450054193.0000000000420000.00000004.00000001.01000000.00000008.sdmp, GamesManagerInstaller.exe, 00000005.00000002.3453979856.000000000041F000.00000004.00000001.01000000.0000000B.sdmp, GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3294185869.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3293772599.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3293940425.0000000003312000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: GamesManager.exe, 00000007.00000003.3292239522.0000000003224000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.ssc.lt/root-a/cacrl.crl0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.starfieldtech.com/sfroot-g2.crl0L
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.starfieldtech.com/sfroot.crl0L
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.startssl.com/sfsca.crl0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.startssl.com/sfsca.crl0f
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.thawte.com/ThawtePCA-G3.crl0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.thawte.com/ThawtePCA.crl0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.thawte.com/ThawtePremiumServerCA.crl0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl.ws.symantec.com/universal-root.crl0
Source: file.exe, 00000000.00000003.2743256931.0000000000739000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000002.3450054193.0000000000420000.00000004.00000001.01000000.00000008.sdmp, GamesManagerInstaller.exe, 00000005.00000002.3453979856.000000000041F000.00000004.00000001.01000000.0000000B.sdmp, GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3293772599.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3293940425.0000000003312000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: file.exe, 00000000.00000003.2743256931.0000000000739000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000002.3450054193.0000000000420000.00000004.00000001.01000000.00000008.sdmp, GamesManagerInstaller.exe, 00000005.00000002.3453979856.000000000041F000.00000004.00000001.01000000.0000000B.sdmp, GamesManager.exe, 00000007.00000003.3293772599.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3457869406.0000000003119000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3293940425.0000000003312000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: file.exe, 00000000.00000003.2743256931.0000000000739000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000002.3450054193.0000000000420000.00000004.00000001.01000000.00000008.sdmp, GamesManagerInstaller.exe, 00000005.00000002.3453979856.000000000041F000.00000004.00000001.01000000.0000000B.sdmp, GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3293772599.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3293940425.0000000003312000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: file.exe, 00000000.00000003.2743256931.0000000000739000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000002.3450054193.0000000000420000.00000004.00000001.01000000.00000008.sdmp, GamesManagerInstaller.exe, 00000005.00000002.3453979856.000000000041F000.00000004.00000001.01000000.0000000B.sdmp, GamesManager.exe, 00000007.00000003.3293772599.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3457869406.0000000003119000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3293940425.0000000003312000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crls1.wosign.com/ca1.crl0m
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crls1.wosign.com/ca1.crl0q
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://crt.rootg2.amazontrust.com/rootg2.cer0=
Source: file.exe, 00000000.00000003.2743256931.0000000000739000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000002.3450054193.0000000000420000.00000004.00000001.01000000.00000008.sdmp, GamesManagerInstaller.exe, 00000005.00000002.3453979856.000000000041F000.00000004.00000001.01000000.0000000B.sdmp, GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3294185869.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3293772599.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3293940425.0000000003312000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crt.usertrust.c
Source: GamesManager.exe, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp String found in binary or memory: http://d1.iwin.com/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B6E5000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://dev.chromium.org/throttling
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B6E5000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://developer.chrome.com/apps/declare_permissions.html
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B6E5000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://developer.chrome.com/extensions/manifest.html#permissions
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B6E5000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://developer.chrome.com/extensions/manifest.html#permissionshttp://developer.chrome.com/apps/dec
Source: GamesManager.exe, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp String found in binary or memory: http://dl.iwin.com/
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: GamesManagerInstaller.exe, 00000005.00000002.3457394501.000000000087A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.iwincdn.com/premium/unifiedgs/unifiedgames/download/win32/gamescom/2.1.30/GamesManag
Source: GamesManagerInstaller.exe, 00000004.00000002.3454139613.00000000007B1000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000005.00000002.3457394501.00000000008DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://events.iwin.com/
Source: GamesManagerInstaller.exe, 00000005.00000002.3457394501.00000000008DB000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000005.00000003.3335557285.000000000355C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://events.iwin.com/eventjson
Source: GamesManagerInstaller.exe, 00000004.00000003.2792537522.0000000000791000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000002.3454139613.0000000000791000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000003.2792766491.0000000000791000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://events.iwin.com/eventjsonD
Source: GamesManagerInstaller.exe, 00000004.00000002.3452828458.0000000000755000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000005.00000002.3457394501.000000000087A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://events.iwin.com/eventjsonapplication/json/contenttype/TOSTACK
Source: GamesManagerInstaller.exe, 00000004.00000002.3452828458.0000000000770000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000003.2792623133.0000000000770000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000005.00000002.3457394501.00000000008A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://events.iwin.com/eventjsonns
Source: GamesManagerInstaller.exe, 00000005.00000002.3457394501.00000000008DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://events.iwin.com/eventjsonw
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: http://g.co/chromeent/learn
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://g.symcb.com/GeoTrustPCA-G3.crl0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://g.symcb.com/crls/gtglobal.crl0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://g.symcb.com/crls/gtglobal.crl0.
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://g.symcd.com0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://g.symcd.com0L
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://g1.symcb.com/GeoTrustPCA.crl0)
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://g1.symcb.com/crls/gtglobal.crl0/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://g2.symcb.com0G
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://g2.symcb.com0L
Source: GamesManager.exe, 00000007.00000002.3468598889.0000000009505000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3435818741.0000000009502000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3467967071.00000000094AB000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3435443107.00000000094FB000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3433523957.0000000009466000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3434974412.00000000094AB000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3435724576.00000000094FC000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3435200792.0000000009466000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3467967071.0000000009481000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3467967071.000000000945D000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3434974412.000000000946E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://getbootstrap.com)
Source: GamesManager.exe, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp String found in binary or memory: http://gm.iwin.com/
Source: GamesManager.exe, 00000007.00000003.3293772599.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp String found in binary or memory: http://gm/iwin/index.html
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3450365375.00000000005C5000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3403683729.0000000006508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3458934885.00000000036C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://gm/splash.html?launchurl=https://ugm3-msn.iwin.com/
Source: GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3457869406.0000000003119000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://gm/splash.html?launchurl=https://ugm3-msn.iwin.com/:254):
Source: GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3457869406.0000000003119000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://gm/splash.html?launchurl=https://ugm3-msn.iwin.com/:273):
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://gm/splash.html?launchurl=https://ugm3-msn.iwin.com/dler
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: http://goo.gl/Y1OdAq
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://google.com
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://google.comhttps://accounts.google.comhttps://www.googleapis.comClientLoginServiceLoginembedde
Source: GamesManager.exe, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp String found in binary or memory: http://help.iwin.com/%s
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://html4/loose.dtd
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://imgs.sapo.pt/images/sapo.ico
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://imgs.sapo.pt/images/sapo.icohttp://pesquisa.sapo.pt/?q=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://isrg.trustid.ocsp.identrust.com0;
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://l.twimg.com/i/hpkp_report
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://l.twimg.com/i/hpkp_reportH
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://mystart.incredibar.com/?search=
Source: file.exe, file.exe, 00000000.00000002.2780484474.0000000000409000.00000004.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000000.2185417676.0000000000409000.00000008.00000001.01000000.00000003.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: file.exe, 00000000.00000002.2780484474.0000000000409000.00000004.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000000.2185417676.0000000000409000.00000008.00000001.01000000.00000003.sdmp, GamesManagerInstaller.exe, 00000004.00000002.3449968912.0000000000409000.00000002.00000001.01000000.00000008.sdmp, GamesManagerInstaller.exe, 00000004.00000000.2779048812.0000000000409000.00000002.00000001.01000000.00000008.sdmp, GamesManagerInstaller.exe, 00000005.00000000.2831187844.0000000000408000.00000002.00000001.01000000.0000000B.sdmp, GamesManagerInstaller.exe, 00000005.00000002.3453870003.0000000000408000.00000002.00000001.01000000.0000000B.sdmp, toasterinstaller.exe, 00000006.00000002.3286851401.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, toasterinstaller.exe, 00000006.00000000.3133734147.000000000040A000.00000008.00000001.01000000.0000000D.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://o.ss2.us/0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2743256931.0000000000739000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000002.3450054193.0000000000420000.00000004.00000001.01000000.00000008.sdmp, GamesManagerInstaller.exe, 00000005.00000002.3453979856.000000000041F000.00000004.00000001.01000000.0000000B.sdmp, GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3293772599.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3293940425.0000000003312000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp.digicert.com0K
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp.digicert.com0M
Source: file.exe, 00000000.00000003.2743256931.0000000000739000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000002.3450054193.0000000000420000.00000004.00000001.01000000.00000008.sdmp, GamesManagerInstaller.exe, 00000005.00000002.3453979856.000000000041F000.00000004.00000001.01000000.0000000B.sdmp, GamesManager.exe, 00000007.00000003.3293772599.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3457869406.0000000003119000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3293940425.0000000003312000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0N
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp.entrust.net00
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp.entrust.net02
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp.geotrust.com0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp.geotrust.com0L
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp.globalsign.com/rootr10
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp.godaddy.com/02
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp.godaddy.com/05
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp.godaddy.com/0J
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp.rootg2.amazontrust.com08
Source: file.exe, 00000000.00000003.2743256931.0000000000739000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000002.3450054193.0000000000420000.00000004.00000001.01000000.00000008.sdmp, GamesManagerInstaller.exe, 00000005.00000002.3453979856.000000000041F000.00000004.00000001.01000000.0000000B.sdmp, GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3294185869.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3293772599.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3293940425.0000000003312000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo.com0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp.starfieldtech.com/08
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp.starfieldtech.com/0;
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp.startssl.com/ca0-
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp.startssl.com/ca00
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp.startssl.com00
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp.thawte.com0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp.thawte.com0;
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp.ws.symantec.com0k
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp1.wosign.com/ca104
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://ocsp1.wosign.com/ca108
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://pca-g3-ocsp.geotrust.com0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://pesquisa.sapo.pt/?q=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://pesquisa.sapo.pt/livesapo?q=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://repository.certum.pl/ca.cer09
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: GamesManager.exe, 00000007.00000003.3292239522.0000000003224000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3292388162.00000000031F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/0
Source: GamesManager.exe, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp String found in binary or memory: http://s-d1.iwin.com/
Source: GamesManager.exe, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp String found in binary or memory: http://s-dl.iwin.com/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://s.ss2.us/r.crl0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://s2.symcb.com0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://s2.symcb.com0k
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://search.goo.ne.jp/sgt.jsp?MT=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://search.goo.ne.jp/web.jsp?MT=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://search.iminent.com/?q=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://search.iminent.com/SearchTheWeb/v6/1033/homepage/Default.aspx#q=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://search.iminent.com/SearchTheWeb/v6/1033/homepage/Result.aspx#q=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://search.iminent.com/Shared/Images/favicon_gl.ico
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://search.iminent.com/Shared/Images/favicon_gl.icohttp://search.iminent.com/?q=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://search.incredibar.com/?q=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://search.incredibar.com/favicon.ico
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://search.incredibar.com/favicon.icohttp://search.incredibar.com/search.php?q=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://search.incredibar.com/search.php?q=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://search.sweetim.com/favicon.ico
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://search.sweetim.com/favicon.icohttp://search.sweetim.com/search.asp?q=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://search.sweetim.com/search.asp?q=
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://start.iminent.com/?q=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://start.iminent.com/StartWeb/1033/homepage/#q=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://subca.ocsp-certum.com0.
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://subca.ocsp-certum.com01
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://suggestion.baidu.com/su?wd=
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: http://support.apple.com/kb/HT203092
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://szukaj.onet.pl/favicon.ico
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://szukaj.onet.pl/favicon.icohttp://szukaj.onet.pl/wyniki.html?qt=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://szukaj.onet.pl/wyniki.html?qt=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://t.symcb.com/ThawtePCA.crl0)
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://t.symcd.com01
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0)
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://t2.symcb.com0;
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://t2.symcb.com0A
Source: toasterinstaller.exe, 00000006.00000003.3182084573.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tweetnacl.cr.yp.to/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://wpad/wpad.dat
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://wpad/wpad.datFindProxyForURLWPAD
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://wpad/wpad.datSHA1LegacyModeLeafIntermediateRoot
Source: GamesManager.exe, 00000007.00000003.3294303609.000000000320F000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3292388162.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3292431512.0000000003205000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.acabogacia.org/doc0
Source: GamesManager.exe, 00000007.00000003.3294303609.000000000320F000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3292388162.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3292431512.0000000003205000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.acabogacia.org0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B6E5000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: GamesManager.exe, 00000007.00000003.3292239522.0000000003224000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.anf.es
Source: GamesManager.exe, 00000007.00000003.3292239522.0000000003224000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3292314334.0000000003213000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.anf.es/es/address-direccion.html
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000003.3292314334.0000000003213000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.certum.pl/CPS0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.chromium.org/developers/how-tos/api-keys
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.chromium.org/developers/how-tos/api-keysGOOGLE_API_KEYdummytokenGOOGLE_DEFAULT_CLIENT_IDG
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B6E5000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.color.org
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B6E5000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.color.orgRegistryNameCustomOutputConditionIdentifiersRGB
Source: GamesManager.exe, 00000007.00000003.3292239522.0000000003224000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3292388162.00000000031F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.datev.de/zertifikat-policy-int0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.digicert.com/CACerts/DigiCertHighAssuranceEVRootCA.crt0
Source: file.exe, 00000000.00000003.2743256931.0000000000739000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000002.3450054193.0000000000420000.00000004.00000001.01000000.00000008.sdmp, GamesManagerInstaller.exe, 00000005.00000002.3453979856.000000000041F000.00000004.00000001.01000000.0000000B.sdmp, GamesManager.exe, 00000007.00000003.3293772599.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3457869406.0000000003119000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3293940425.0000000003312000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com/CPS0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.entrust.net/CPS0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.entrust.net/rpa0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.geotrust.com/resources/cps0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.geotrust.com/resources/cps0)
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.geotrust.com/resources/cps06
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.geotrust.com/resources/cps0;
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.geotrust.com/resources/cps0A
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.google.com
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.google.comgaia_auth_merge_sessionsStarting
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: GamesManager.exe, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp String found in binary or memory: http://www.iwin.com/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.keynectis.com/PC07
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.keynectis.com/PC08
Source: GamesManager.exe, 00000007.00000003.3292239522.0000000003224000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3292272728.0000000003232000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oaticerts.com/repository.
Source: GamesManager.exe, 00000007.00000003.3292239522.0000000003224000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy-G20
Source: GamesManager.exe, 00000007.00000003.3292239522.0000000003224000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3292187730.000000000323C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.ssc.lt/cps03
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.startssl.com/intermediate.pdf0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.startssl.com/policy.pdf04
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.startssl.com/policy0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.startssl.com/sfsca.crl0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.startssl.com/sfsca.crt0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.symauth.com/cps0(
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.symauth.com/rpa0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.symauth.com/rpa0)
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.symauth.com/rpa00
Source: GamesManager.exe, 00000007.00000002.3459606668.00000000037C0000.00000002.00000001.00040000.00000020.sdmp, GamesManager.exe, 00000007.00000002.3459606668.0000000003D90000.00000002.00000001.00040000.00000020.sdmp String found in binary or memory: http://www.unicode.org/copyright.html
Source: GamesManager.exe, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp String found in binary or memory: http://www.winimage.com/zLibDll
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.wosign.com/policy/0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.zoznam.sk/favicon.ico
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.zoznam.sk/favicon.icohttp://www.zoznam.sk/hladaj.fcgi?s=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.zoznam.sk/hladaj.fcgi?s=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://x.ss2.us/x.cer0&
Source: GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3458594645.00000000032D0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: https://accounts.google.com/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://asac.casa/expectstaple.jsp
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://azreport.report-uri.io/r/default/staple/reportOnly
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ca.search.yahoo.com/favicon.ico
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ca.search.yahoo.com/favicon.icohttps://ca.search.yahoo.com/search?ei=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ca.search.yahoo.com/search?ei=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ca.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://certs.godaddy.com/repository/0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://certs.starfieldtech.com/repository/0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search?ei=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp, GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://chrome.google.com/webstore
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B6E5000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://chrome.google.com/webstore/detail/%s
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B6E5000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://chrome.google.com/webstore/detail/%s--install-chrome-app
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3461793997.0000000004465000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: https://chromium.googlesource.com/chromium/src/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://cl.search.yahoo.com/favicon.ico
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://cl.search.yahoo.com/favicon.icohttps://cl.search.yahoo.com/search?ei=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://cl.search.yahoo.com/search?ei=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://cl.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: GamesManager.exe, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp String found in binary or memory: https://client.iplay.com/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://clients3.google.com/ct_upload
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://clients3.google.com/ct_uploadhttps://log.getdropbox.com/log/expectcthttps://tobiassachs.repo
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://co.search.yahoo.com/favicon.ico
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://co.search.yahoo.com/favicon.icohttps://co.search.yahoo.com/search?ei=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://co.search.yahoo.com/search?ei=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://co.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B6E5000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://crashpad.chromium.org/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B6E5000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://crashpad.chromium.org/bug/new
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B6E5000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: https://crbug.com/557445).
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ct.googleapis.com/aviator/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ct.googleapis.com/aviator/aviator.ct.googleapis.com0Y0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ct.googleapis.com/icarus/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ct.googleapis.com/icarus/icarus.ct.googleapis.com0Y0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ct.googleapis.com/pilot/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ct.googleapis.com/pilot/pilot.ct.googleapis.com0Y0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ct.googleapis.com/rocketeer/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ct.googleapis.com/rocketeer/rocketeer.ct.googleapis.com0Y0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ct.googleapis.com/skydiver/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ct.googleapis.com/skydiver/skydiver.ct.googleapis.com0Y0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ct.izenpe.com/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ct.izenpe.com/izenpe1.ct.googleapis.com
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ct.startssl.com/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ct.startssl.com/startcom1.ct.googleapis.com0Y0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ct.ws.symantec.com/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ct.ws.symantec.com/symantec.ct.googleapis.com0Y0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ct1.digicert-ct.com/log/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ct1.digicert-ct.com/log/digicert.ct.googleapis.com0Y0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ct2.digicert-ct.com/log/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ct2.digicert-ct.com/log/digicert2.ct.googleapis.com0Y0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ctlog-gen2.api.venafi.com/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ctlog-gen2.api.venafi.com/venafi2.ct.googleapis.com0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ctlog.api.venafi.com/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ctlog.api.venafi.com/venafi.ct.googleapis.com
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ctlog.wosign.com/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ctlog.wosign.com/wosign1.ct.googleapis.com0Y0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ctserver.cnnic.cn/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ctserver.cnnic.cn/cnnic.ct.googleapis.com0Y0
Source: GamesManager.exe, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp String found in binary or memory: https://d1.iwin.com/
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: https://developer.chrome.com/devtools/docs/remote-debugging#reverse-port-forwarding
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: https://developers.google.com/chrome-developer-tools/docs/remote-debugging
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://dk.search.yahoo.com/favicon.ico
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://dk.search.yahoo.com/favicon.icohttps://dk.search.yahoo.com/search?ei=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://dk.search.yahoo.com/search?ei=
Source: GamesManager.exe, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp String found in binary or memory: https://dl.iwin.com/
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: https://github.com/Polymer/polymer/issues/3669
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: https://github.com/PolymerElements/neon-animation/issues/101
Source: GamesManager.exe, 00000007.00000002.3468598889.0000000009505000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3435818741.0000000009502000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3467967071.00000000094AB000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3435443107.00000000094FB000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3433523957.0000000009466000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3434974412.00000000094AB000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3435724576.00000000094FC000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3435200792.0000000009466000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3467967071.0000000009481000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3467967071.000000000945D000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3434974412.000000000946E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: GamesManager.exe, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp String found in binary or memory: https://gm.iwin.com/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://go.imgsmail.ru/favicon.ico
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://go.imgsmail.ru/favicon.icohttps://go.mail.ru/search?q=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://go.mail.ru/search?q=
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3465766605.0000000006491000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://iwin.com/
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://iwin.com/ThH
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://iwin.com/win.com/
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3435443107.00000000094F0000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3467967071.0000000009481000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3434724235.00000000094AC000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3434974412.000000000946E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://iwin.zendesk.com/hc/en-us
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://lh3.googleusercontent.com
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://log.certly.io/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://log.certly.io/certly.ct.googleapis.com
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://log.getdropbox.com/hpkp
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://log.getdropbox.com/hpkpP
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://log.getdropbox.com/log/expectct
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://log.getdropbox.com/log/ocsp_expect_staple
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://log.ncsccs.com/report/expectct
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://log.ncsccs.com/report/expectocsp
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://log.ncsccs.com/report/hpkp
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://log.ncsccs.com/report/hpkp8
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://mammoth.ct.comodo.com/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://mammoth.ct.comodo.com/comodo-mammoth.ct.googleapis.com)
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://matteomarescotti.report-uri.io/r/default/staple/reportOnly
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://minecraft.report-uri.io/r/default/staple/reportOnly
Source: GamesManager.exe, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp String found in binary or memory: https://p.iwin.com/gm/autoupdate/$
Source: file.exe, 00000000.00000002.2780783678.0000000000718000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2780783678.00000000006E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2780073351.0000000000718000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2780114048.00000000006E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://p.iwin.com/gm/live/UgmMsnInstaller.exe
Source: file.exe, 00000000.00000002.2780783678.00000000006E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2780114048.00000000006E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://p.iwin.com/gm/live/UgmMsnInstaller.exedownloadsuccessDownload
Source: GamesManager.exe, 00000007.00000003.3430073394.0000000009481000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3465766605.0000000006491000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3457869406.0000000003119000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3433173877.0000000009481000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3467967071.0000000009481000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3434974412.000000000946E000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3458594645.00000000032D0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://play.iwincdn.com/assets/site/ajax-loader-2-62916463ab77e7f2aea4f13eee7b21c1801a6997cd15f90dd
Source: GamesManager.exe, 00000007.00000002.3465766605.000000000652A000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3467967071.0000000009481000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://play.iwincdn.com/assets/site/ajax-loader-443ab5e1c534732de9740651feb46b329eb7ae230636a80d0d9
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://play.iwincdn.com/assets/site/icomoon-159fa0987ef7509a06eb256d264b633642ba09033e3ad84fcb524ac
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://play.iwincdn.com/assets/site/moredata-79398f1ef11de2f4203c85014a39f1c1a8b74ef95a704568a49324
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://play.iwincdn.com/assets/site/no-internet-1f884dafc618d40d55fd8ce1b9d2154e22339ef1c67669c782b
Source: GamesManager.exe, 00000007.00000002.3465766605.000000000652A000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3467967071.0000000009481000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3434974412.000000000946E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://play.iwincdn.com/assets/ugm3-msn_iwin_com/loading-c7c643216b5fbb8e3554c4377ac2fa5f8b4decf15d
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://play.iwincdn.com/assets/ugm3-msn_iwin_com/logo-header-c6983a12a93990ab7e6d5224d41eea343f5188
Source: GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://play.iwincdn.com/assets/ugm3-msn_iwin_com/logo-loading-c6983a12a93990ab7e6d5224d41eea343f518
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://play.iwincdn.com/assets/ugm3-msn_iwin_com/logo-modal-c6983a12a93990ab7e6d5224d41eea343f5188f
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://play.iwincdn.com/assets/ugm3-msn_iwin_com/offline-94e0c02b76a422b1c94ca5ad97c852ca577079edb6
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://report.badssl.com/expect-staple
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://report.badssl.com/expect-staplehttps://log.getdropbox.com/log/ocsp_expect_staplehttps://repo
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://reporting.caddyserver.com/expect-staple
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ro.search.yahoo.com/favicon.ico
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ro.search.yahoo.com/favicon.icohttps://ro.search.yahoo.com/search?ei=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://ro.search.yahoo.com/search?ei=
Source: GamesManager.exe, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp String found in binary or memory: https://s-d1.iwin.com/
Source: GamesManager.exe, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp String found in binary or memory: https://s-dl.iwin.com/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sabre.ct.comodo.com/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://sabre.ct.comodo.com/comodo-sabre.ct.googleapis.com0Y0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://scotthelme.report-uri.io/r/default/staple/reportOnly
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://search.goo.ne.jp/cdn/common/img/favicon.ico
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://search.goo.ne.jp/cdn/common/img/favicon.icohttps://search.goo.ne.jp/web.jsp?MT=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://search.goo.ne.jp/sgt.jsp?MT=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://search.goo.ne.jp/web.jsp?MT=
Source: file.exe, 00000000.00000003.2743256931.0000000000739000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000002.3450054193.0000000000420000.00000004.00000001.01000000.00000008.sdmp, GamesManagerInstaller.exe, 00000005.00000002.3453979856.000000000041F000.00000004.00000001.01000000.0000000B.sdmp, GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3294185869.00000000031D6000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3293772599.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3293940425.0000000003312000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sectigo.com/CPS0D
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sirius.ws.symantec.com/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://sirius.ws.symantec.com/symantec-sirius.ct.googleapis.com0Y0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://staple.watch/cdn-cgi/beacon/expect-staple
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://suggests.go.mail.ru/chrome?q=
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_javaIKg
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime0J
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_realload.phpvKH
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://tobiassachs.report-uri.io/r/default/ct/reportOnly
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://tobiassachs.report-uri.io/r/default/staple/reportOnly
Source: file.exe, 00000000.00000002.2781113146.00000000026F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com
Source: GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3469316800.00000000095C9000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3455355086.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3450365375.00000000005C5000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3465766605.0000000006491000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3456414669.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3454978480.0000000000E90000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3457869406.0000000003119000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3450109026.0000000000490000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3403683729.0000000006508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3294339321.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3458934885.00000000036EE000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3458594645.00000000032D0000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3450365375.0000000000500000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/(
Source: GamesManager.exe, 00000007.00000002.3455355086.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3456414669.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3454978480.0000000000E90000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/-config.channel=20000009-config.sku=FIRST_INSTALL-config.iwinrequest=PF/17
Source: GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/:
Source: GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3457869406.0000000003119000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3458594645.00000000032D0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/:0):
Source: GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/:5):
Source: GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/:53
Source: GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/:q
Source: GamesManager.exe, 00000007.00000002.3465766605.000000000652A000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3456414669.00000000028B6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/=
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3458594645.00000000032D0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/P
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/auth
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/authupsell
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/by-category
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/by-categorycy
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/cancel/flow
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/cancel/flowser
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/categories
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/categories~
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/entry-upsell
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/entry-upsellsF
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/exit-upsell
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/exit-upsellserT
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/favicon.ico
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/home
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/homel/flow%
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/kO
Source: GamesManager.exe, 00000007.00000002.3456414669.00000000028B6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/n.iwi/
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/new
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/newesflow
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/od8
Source: GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3465766605.0000000006491000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/offline
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/offline$
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/offline(
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/offline/
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/offline=
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/offlineM
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/offline_
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/offline_session/0/10
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/offlineache
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/offlineacheicex
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/offlineell
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/offlinees
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/offlineesons
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/offlinei
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/offlineoryome
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/offlinep
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/offlinepolicy
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/offliner
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/offlinew
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/outright-purchase-payment
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/outright-purchase-signin
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/privacy-policy
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/privacy-policye
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/publisher
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/publisherllI
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/search-results
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/subscribe/payment-details
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/subscribe/start-membership
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/terms-of-service
Source: GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3465766605.0000000006491000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3403683729.0000000006508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3458934885.00000000036EE000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3458934885.00000000036C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/ugm.appcache
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/ugm.appcacheBM
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/welcome/browser
Source: GamesManager.exe, 00000007.00000002.3465766605.0000000006340000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/welcome/browser(
Source: GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ugm3-msn.iwin.com/~
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vega.ws.symantec.com/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://vega.ws.symantec.com/symantec-vega.ct.googleapis.com0Y0
Source: GamesManager.exe, 00000007.00000003.3292239522.0000000003224000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.certicamara.com/marco-legal0Z
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B6E5000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://wicg.github.io/cors-rfc1918/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://wicg.github.io/reporting.
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.alphassl.com/repository/03
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.baidu.com/#ie=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.baidu.com/favicon.ico
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.baidu.com/favicon.icohttps://www.baidu.com/#ie=
Source: file.exe, 00000000.00000003.2743256931.0000000000739000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000002.3450054193.0000000000420000.00000004.00000001.01000000.00000008.sdmp, GamesManagerInstaller.exe, 00000005.00000002.3453979856.000000000041F000.00000004.00000001.01000000.0000000B.sdmp, GamesManager.exe, 00000007.00000002.3457869406.00000000031F7000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000003.3293772599.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000003.3293940425.0000000003312000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.geotrust.com/resources/cps04
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.geotrust.com/resources/cps06
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.geotrust.com/resources/repository0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.globalsign.com/repository/0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.globalsign.com/repository/03
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: https://www.google.TLD
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3478924965.000000006BE59000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.google.com
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp, GamesManager.exe, 00000007.00000002.3478924965.000000006BE59000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3458934885.0000000003743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.google.com/accounts/OAuthLogin
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.google.com/accounts/OAuthLoginhttps://www.googleapis.com/auth/userinfo.emailhttps://www.
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp, GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.google.com/cloudprint
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: https://www.google.com/cloudprint/enable_chrome_connector
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.google.com/favicon.ico
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.google.com/settings/security/lesssecureapps
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.google.comgaia_auth_log_out
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.googleapis.com
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.googleapis.com/auth/any-api
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.googleapis.com/auth/chromeosdevicemanagement
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.googleapis.com/auth/chromesync
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.googleapis.com/auth/chromesync_playpen
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B6E5000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B6E5000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonlycom.google.crx.blacklistX-GoogleUpdate-Intera
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: https://www.googleapis.com/auth/cryptauth
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.googleapis.com/auth/googletalk
Source: GamesManager.exe, 00000007.00000002.3461793997.00000000042B0000.00000002.00000001.00040000.00000022.sdmp String found in binary or memory: https://www.googleapis.com/auth/proximity_auth
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.googleapis.com/auth/userinfo.profile
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.googleapis.com/auth/userinfo.profileOnGetTokenSuccessgoogle_service_auth_errorOnGetToken
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B6E5000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.googleapis.com/rpc
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B6E5000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.googleapis.com/rpcresult.spellingCheckResponse.misspellingserror
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.googleapis.comhttps://lh3.googleusercontent.comdrive/v2/aboutdrive/v2/appsdrive/v2/chang
Source: GamesManager.exe, GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp String found in binary or memory: https://www.iwin.com/
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.najdi.si/assets/PROD-1.5.16/ctx/images/favicon.ico
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.najdi.si/assets/PROD-1.5.16/ctx/images/favicon.icohttps://www.najdi.si/search.jsp?q=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.najdi.si/search.jsp?q=
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.thawte.com/cps0
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.thawte.com/cps0)
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.thawte.com/cps02
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://www.thawte.com/cps07
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: https://yastatic.net/lego/_/pDu9OWAQKB0s2J9IojKpiS_Eho.ico
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00404EB9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_00404EB9
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Code function: 4_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 4_2_004044D1
Installs a raw input device (often for capturing keystrokes)
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: RegisterRawInputDevices() failed for RIDEV_INPUTSINK memstr_9a676dd4-9

System Summary
barindex
Windows shortcut file (LNK) contains suspicious command line arguments
Source: MSN Games Manager.lnk.5.dr LNK file: -config.channel=20000009 -config.uri=https://ugm3-msn.iwin.com/
Source: MSN Games Manager.lnk0.5.dr LNK file: -config.channel=20000009 -config.uri=https://ugm3-msn.iwin.com/
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Code function: 5_2_100010D0 GetVersionExW,LoadLibraryW,GetProcAddress,LocalAlloc,LocalAlloc,NtQuerySystemInformation,LocalFree,LocalAlloc,FreeLibrary,lstrcpynW,lstrcmpiW,LocalFree,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,lstrlenW,lstrlenA,MultiByteToWideChar,lstrcmpiW,CloseHandle,FreeLibrary, 5_2_100010D0
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004030CB EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,ExitProcess,CoUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, 0_2_004030CB
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Code function: 4_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx, 4_2_004038AF
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Code function: 5_2_004039E3 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx, 5_2_004039E3
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Code function: 6_2_00403334 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,CoUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 6_2_00403334
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004046CA 0_2_004046CA
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00405FA8 0_2_00405FA8
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Code function: 4_2_0040737E 4_2_0040737E
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Code function: 4_2_00406EFE 4_2_00406EFE
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Code function: 4_2_004079A2 4_2_004079A2
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Code function: 4_2_004049A8 4_2_004049A8
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Code function: 5_2_0040761C 5_2_0040761C
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Code function: 5_2_00407033 5_2_00407033
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Code function: 5_2_00404ADC 5_2_00404ADC
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Code function: 6_2_004070D4 6_2_004070D4
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Code function: 6_2_004068FD 6_2_004068FD
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Code function: 6_2_00404BBF 6_2_00404BBF
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_00A7B300 7_2_00A7B300
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_00A85D30 7_2_00A85D30
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_00A7AD00 7_2_00A7AD00
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_00A8DD70 7_2_00A8DD70
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_00A7AD42 7_2_00A7AD42
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_00A74EB0 7_2_00A74EB0
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_00A7AF00 7_2_00A7AF00
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE556E8 7_2_6CE556E8
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE8FCC5 7_2_6CE8FCC5
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE6ECA0 7_2_6CE6ECA0
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE58C23 7_2_6CE58C23
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE7EC2B 7_2_6CE7EC2B
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE66D40 7_2_6CE66D40
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE82EAF 7_2_6CE82EAF
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE67E40 7_2_6CE67E40
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE95F89 7_2_6CE95F89
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE8B820 7_2_6CE8B820
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE7E813 7_2_6CE7E813
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE7F495 7_2_6CE7F495
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE98561 7_2_6CE98561
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE830DF 7_2_6CE830DF
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE7E080 7_2_6CE7E080
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE7F060 7_2_6CE7F060
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE73111 7_2_6CE73111
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE673E0 7_2_6CE673E0
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE7B3FC 7_2_6CE7B3FC
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE683C0 7_2_6CE683C0
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE7E317 7_2_6CE7E317
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_00A7B300 9_2_00A7B300
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_00A85D30 9_2_00A85D30
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_00A7AD00 9_2_00A7AD00
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_00A8DD70 9_2_00A8DD70
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_00A7AD42 9_2_00A7AD42
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_00A74EB0 9_2_00A74EB0
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_00A7AF00 9_2_00A7AF00
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_107AD460 9_2_107AD460
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_1E1AE9A0 9_2_1E1AE9A0
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 11_2_1EFAE9A0 11_2_1EFAE9A0
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 11_2_2A1AD460 11_2_2A1AD460
Enables security privileges
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Process token adjusted: Security Jump to behavior
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Code function: String function: 00406404 appears 58 times
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: String function: 00C70F80 appears 32 times
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: String function: 6CE5BD30 appears 35 times
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: String function: 6CE79BCF appears 56 times
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: String function: 6CE53604 appears 68 times
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: String function: 00C70756 appears 36 times
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: String function: 6CE7B920 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Code function: String function: 004062CF appears 58 times
PE file contains executable resources (Code or Archives)
Source: GamesManagerInstaller.exe.0.dr Static PE information: Resource name: RT_VERSION type: x86 executable not stripped
PE file contains more sections than normal
Source: libcef.dll.5.dr Static PE information: Number of sections : 12 > 10
Uses 32bit PE files
Source: file.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engine Classification label: mal57.spyw.evad.winEXE@13/206@1/4
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE5CE40 FormatMessageA,GetLastError, 7_2_6CE5CE40
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Code function: 6_2_00403334 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,CoUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 6_2_00403334
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004041CD GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 0_2_004041CD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00402020 CoCreateInstance,MultiByteToWideChar, 0_2_00402020
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\GamesManager Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Mutant created: NULL
Source: C:\Users\user\Desktop\file.exe Mutant created: \Sessions\1\BaseNamedObjects\Name
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Mutant created: \Sessions\1\BaseNamedObjects\7a0d73ab-e51e-567f-8ccd-0dcc75c9699a
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\nsjAA07.tmp Jump to behavior
Source: file.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO games (sku, change, registry_key, value, type) VALUES ('%s', '%s', '%s', '%d', '%s');Y
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE games (IDINTEGER PRIMARY KEY AUTOINCREMENT,skuTEXT NOT NULL,changeTEXT NOT NULL,registry_keyTEXT NOT NULL,typeTEXT NOT NULL,valueTEXT);>
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO games (sku, change, registry_key, value, type) VALUES ('%s', '%s', '%s', '%d', '%s');`
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO games (sku, change, registry_key, type) VALUES ('%s', '%s', '%s', '%s');n
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO games (sku, change, registry_key, type) VALUES ('%s', '%s', '%s', '%s');k
Source: GamesManager.exe Binary or memory string: SELECT * FROM games WHERE sku = '%s';
Source: GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: UPDATE downloads SET STATUS = 'REMOVED' WHERE SKU = '%s';B
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO games (sku, change, registry_key, value, type) VALUES ('%s', '%s', '%s', '%d', '%s');s
Source: GamesManager.exe Binary or memory string: CREATE TABLE games (IDINTEGER PRIMARY KEY AUTOINCREMENT,skuTEXT NOT NULL,changeTEXT NOT NULL,registry_keyTEXT NOT NULL,typeTEXT NOT NULL,valueTEXT);
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO games (sku, change, registry_key, value, type) VALUES ('%s', '%s', '%s', '%s', '%s');{
Source: GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006BE59000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: UPDATE logins SET skip_zero_click = 1 WHERE origin_url = ?;
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp Binary or memory string: INSERT INTO downloads (STATUS,SKU,NAME,URI,DRM,LOCALFILE,TOTALSIZE,LASTTIME,PRIORITY,LASTUPDATED) VALUES ('%s','%s','%s','%s','%s','%s',%l,%l,%l,CURRENT_TIMESTAMP);
Source: GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp Binary or memory string: SELECT LOCALFILE, URI, TOTALSIZE FROM downloads WHERE SKU='%s' AND STATUS != 'REMOVED';
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT * FROM games WHERE sku = '%s';0
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp Binary or memory string: SELECT STREAMDATA FROM downloads WHERE SKU = '%s' AND STATUS = 'DOWNLOADING';
Source: GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO games (sku, change, registry_key, value, type) VALUES ('%s', '%s', '%s', '%s', '%s');
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp Binary or memory string: UPDATE downloads SET TOTALSIZE = '%l', STREAMDATA = '%s', LASTUPDATED = CURRENT_TIMESTAMP WHERE SKU = '%s' AND STATUS != 'REMOVED';
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006BE59000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: INSERT INTO share_info VALUES(?, ?, ?, ?, ?);
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO games (sku, change, registry_key, value, type) VALUES ('%s', '%s', '%s', '%d', '%s');@
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO games (sku, change, registry_key, value, type) VALUES ('%s', '%s', '%s', '%s', '%s');
Source: GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp Binary or memory string: SELECT name FROM sqlite_master WHERE type='table' AND name='%s';Database Opened: %sDatabase::opend:\jenkins\workspace\client3.exe.unifiedgamesmanager\ugmexe\src\database.cppUnable to open channel database: %s due to error [%s]dataDatabase query prepare error [%s] for statement [%s]Database::executeUnable to handle sqlite3 column type [%d] in sql request [%s]Database::executeForJsonCREATEDDOWNLOADINGREMOVEDdownloadsCREATE TABLE downloads(ID INTEGER PRIMARY KEY AUTOINCREMENT,STATUSTEXT NOT NULL,SKU TEXT NOT NULL,NAME TEXT NOT NULL,URITEXT,DRM TEXT,LOCALFILETEXT,STREAMDATATEXT,TOTALSIZEINTEGER,LASTTIMEINTEGER,PRIORITYINTEGER,LASTUPDATED DATETIME,CREATED DATETIME DEFAULT CURRENT_TIMESTAMP);INSERT INTO downloads (STATUS,SKU,NAME,URI,DRM,LOCALFILE,TOTALSIZE,LASTTIME,PRIORITY,LASTUPDATED) VALUES ('%s','%s','%s','%s','%s','%s',%l,%l,%l,CURRENT_TIMESTAMP);SELECT * FROM downloads WHERE STATUS = 'DOWNLOADING' OR STATUS = 'CREATED';UPDATE downloads SET STATUS = 'REMOVED';SELECT STREAMDATA FROM downloads WHERE SKU = '%s' AND STATUS = 'DOWNLOADING';UPDATE downloads SET STATUS = 'REMOVED' WHERE SKU = '%s';UPDATE downloads SET TOTALSIZE = '%l', STREAMDATA = '%s', LASTUPDATED = CURRENT_TIMESTAMP WHERE SKU = '%s' AND STATUS != 'REMOVED';SELECT LOCALFILE, URI, TOTALSIZE FROM downloads WHERE SKU='%s' AND STATUS != 'REMOVED';''Game Download Extracted from Registry: [%s] %sDownloadsDatabase::onLegacyScand:\jenkins\workspace\client3.exe.unifiedgamesmanager\ugmexe\src\downloadsdatabase.cppError Updating Downloads Database Table [%s]DownloadsDatabase::addDownloadNAMEDRMURIGame Download Found: [%s] %sDownloadsDatabase::startExistingDownloadsError Removing all Downloads from Database Table [%s]DownloadsDatabase::clearAllExistingDownloadsDownloadsDatabase::removeDownloadDownloadsDatabase::updateProgressERR_DEPS_MISSINGERR_CDAT_MISSINGERR_CDAT_LOCKEDERR_WEBDATA_LOCKEDERR_BROWSER_FAILEDERR_CO_FAILEDERR_VIEW_FAILEDERR_WINDOW_FAILEDERR_BROWSER_CRASHEDERR_INVALID_LAUNCHURLGamesManagerConfigReadyGamesManagerGamesReadyGameDownloadStartGameDownloadProgessGameDownloadStalledGameDownloadFailedGameDownloadFailedRetryGameInstallStartedGameInstallProgressGameInstallFailedGameInstallFailedRetryGameInstallCompletedGameReadyGameDownloadPausedGameDownloadResumedGameRemoveStartGameRemoveFailedGameRemoveCompletedGameLaunchStartedGameLaunchFailedGameLaunchCompleteGameOverCertificateGrantStartedCertificateGrantFailedCertificateGrantCompleteCertificateRevokeStartedCertificateRevokeFailedCertificateRevokeCompletedGameUninstallStartedGameUninstallFailedGameUninstallCompletedGameRequestedGameUpdateDownloadingGameUpdateApplyingGameUpdateCompleteGameUpdateFailedGameProtocolSystemRequestQUITPOPUP_CLOSEDNETWORK_TOOLS_RUNNINGNETWORK_TOOLS_FAILEDNETWORK_TOOLS_COMPLETEErrorStateDownloadingPausedFailedRemovingInstallingInstalledRevokingUninstallingReadyRemovedLaunchingLaunchedGrantingFailedReadyNotScannedCREATE TABLE IF NOT EXISTS games(sku TEXT PRI
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO games (sku, change, registry_key, value, type) VALUES ('%s', '%s', '%s', '%s', '%s');#
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006BE59000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: SELECT signon_realm, origin_url, blacklisted_by_user FROM logins;
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT * FROM games WHERE sku = '%s';J
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO games (sku, change, registry_key, value, type) VALUES ('%s', '%s', '%s', '%d', '%s');P
Source: GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp Binary or memory string: UPDATE downloads SET STATUS = 'REMOVED' WHERE SKU = '%s';
Source: GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp Binary or memory string: SELECT * FROM games WHERE sku=='%s';
Source: GamesManager.exe Binary or memory string: INSERT INTO games (sku, change, registry_key, value, type) VALUES ('%s', '%s', '%s', '%d', '%s');
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT * FROM games WHERE sku = '%s';@c
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp Binary or memory string: SELECT * FROM downloads WHERE STATUS = 'DOWNLOADING' OR STATUS = 'CREATED';
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO games (sku, change, registry_key, value, type) VALUES ('%s', '%s', '%s', '%s', '%s');'
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO games (sku, change, registry_key, type) VALUES ('%s', '%s', '%s', '%s');@
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO games (sku, change, registry_key, value, type) VALUES ('%s', '%s', '%s', '%d', '%s');
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT * FROM games WHERE sku = '%s';
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp Binary or memory string: CREATE TABLE downloads(ID INTEGER PRIMARY KEY AUTOINCREMENT,STATUSTEXT NOT NULL,SKU TEXT NOT NULL,NAME TEXT NOT NULL,URITEXT,DRM TEXT,LOCALFILETEXT,STREAMDATATEXT,TOTALSIZEINTEGER,LASTTIMEINTEGER,PRIORITYINTEGER,LASTUPDATED DATETIME,CREATED DATETIME DEFAULT CURRENT_TIMESTAMP);
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO games (sku, change, registry_key, value, type) VALUES ('%s', '%s', '%s', '%d', '%s');@M
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO games (sku, change, registry_key, value, type) VALUES ('%s', '%s', '%s', '%d', '%s');8P
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE downloads(ID INTEGER PRIMARY KEY AUTOINCREMENT,STATUSTEXT NOT NULL,SKU TEXT NOT NULL,NAME TEXT NOT NULL,URITEXT,DRM TEXT,LOCALFILETEXT,STREAMDATATEXT,TOTALSIZEINTEGER,LASTTIMEINTEGER,PRIORITYINTEGER,LASTUPDATED DATETIME,CREATED DATETIME DEFAULT CURRENT_TIMESTAMP);3
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO games (sku, change, registry_key, type) VALUES ('%s', '%s', '%s', '%s');6
Source: GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp Binary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO games (sku, change, registry_key, type) VALUES ('%s', '%s', '%s', '%s');3
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT * FROM games WHERE sku = '%s';M3
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT * FROM games WHERE sku = '%s';q
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO games (sku, change, registry_key, type) VALUES ('%s', '%s', '%s', '%s');W
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE games (IDINTEGER PRIMARY KEY AUTOINCREMENT,skuTEXT NOT NULL,changeTEXT NOT NULL,registry_keyTEXT NOT NULL,typeTEXT NOT NULL,valueTEXT);_
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: CREATE TABLE %s (id INTEGER PRIMARY KEY, value TEXT NOT NULL); CREATE UNIQUE INDEX %s_index ON %s(value)
Source: GamesManager.exe Binary or memory string: INSERT INTO games (sku, change, registry_key, type) VALUES ('%s', '%s', '%s', '%s');
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006BFBF000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: SELECT name FROM sqlite_master WHERE type='table';
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE games (IDINTEGER PRIMARY KEY AUTOINCREMENT,skuTEXT NOT NULL,changeTEXT NOT NULL,registry_keyTEXT NOT NULL,typeTEXT NOT NULL,valueTEXT);h
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE games (IDINTEGER PRIMARY KEY AUTOINCREMENT,skuTEXT NOT NULL,changeTEXT NOT NULL,registry_keyTEXT NOT NULL,typeTEXT NOT NULL,valueTEXT);j
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT * FROM games WHERE sku = '%s';|
Source: GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: GamesManager.exe Binary or memory string: INSERT INTO games (sku, change, registry_key, value, type) VALUES ('%s', '%s', '%s', '%s', '%s');
Source: GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS games(sku TEXT PRIMARY KEY, drmType TEXT, drmRemains INTEGER, drmSafety INTEGER, lastState TEXT,downloadTotal INTEGER, downloadCurrent INTEGER,downloadStarted INTEGER);
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp, GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp Binary or memory string: SELECT name FROM sqlite_master WHERE type='table' AND name='%s';
Source: GamesManager.exe, 00000007.00000002.3450365375.0000000000508000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO games (sku, change, registry_key, type) VALUES ('%s', '%s', '%s', '%s');T
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: CREATE TABLE %Q.'%q_content'(%s)("%s"CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));,arg HIDDENCREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);,schema HIDDENPRAGMA %Q.page_sizewinMapfile1winMapfile2
Source: file.exe ReversingLabs: Detection: 23%
Source: GamesManagerInstaller.exe String found in binary or memory: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe" -installer.logstartsent=true -config.channel=20000009 -
Source: GamesManagerInstaller.exe String found in binary or memory: "C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe" -installer.logstartsent=true -config.channel=20000009
Source: GamesManagerInstaller.exe String found in binary or memory: Exec: success (""C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe" -installer.logstartsent=true -config.c
Source: GamesManagerInstaller.exe String found in binary or memory: "C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe" -installer.createiwinshortcuts=yes -config.channel=2000
Source: GamesManagerInstaller.exe String found in binary or memory: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe" -installer.createiwinshortcuts=yes -config.channel=20000
Source: GamesManagerInstaller.exe String found in binary or memory: "C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe" -installer.logstartsent=true -config.channel=20000009
Source: GamesManagerInstaller.exe String found in binary or memory: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe" -installer.logstartsent=true -config.channel=20000009 -
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe "C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe" -installer.createiwinshortcuts=yes -config.channel=20000009 -config.uri=https://ugm3-msn.iwin.com/ -config.channelName=MsnStreaming -config.iwinrequest="PF/1735198334008948550/zengems/51/0"
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Process created: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe "C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe" -installer.logstartsent=true -config.channel=20000009 -config.uri="https://ugm3-msn.iwin.com/" -config.channelName="iWin" -config.sku=FIRST_INSTALL -installer.createshortcutswithname="MSN Games Manager" -autoupdate=1 -config.iwinrequest="PF/1735198334008948550/zengems/51/0"
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Process created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe "C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe" /S --no-desktop-shortcut
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Process created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe "C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe" -config.uri=https://ugm3-msn.iwin.com/ -config.channel="20000009" -config.sku="FIRST_INSTALL" -config.iwinrequest="PF/1735198334008948550/zengems/51/0"
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe "C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe" --type=renderer --no-sandbox --service-pipe-token=97A7B1777A421674542AF2780F1B6D7A --lang=en-US --lang=en-US --log-file="C:\Users\user\AppData\Local\GamesManager_iWin_MSN\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPI" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=97A7B1777A421674542AF2780F1B6D7A --renderer-client-id=2 --mojo-platform-channel-handle=2712 /prefetch:1
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe "C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe" --type=renderer --no-sandbox --service-pipe-token=4AB44524C71BE879F241E5F9C60EF896 --lang=en-US --lang=en-US --log-file="C:\Users\user\AppData\Local\GamesManager_iWin_MSN\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPI" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=4AB44524C71BE879F241E5F9C60EF896 --renderer-client-id=3 --mojo-platform-channel-handle=3168 /prefetch:1
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe "C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe" -installer.createiwinshortcuts=yes -config.channel=20000009 -config.uri=https://ugm3-msn.iwin.com/ -config.channelName=MsnStreaming -config.iwinrequest="PF/1735198334008948550/zengems/51/0" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Process created: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe "C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe" -installer.logstartsent=true -config.channel=20000009 -config.uri="https://ugm3-msn.iwin.com/" -config.channelName="iWin" -config.sku=FIRST_INSTALL -installer.createshortcutswithname="MSN Games Manager" -autoupdate=1 -config.iwinrequest="PF/1735198334008948550/zengems/51/0" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Process created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe "C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe" /S --no-desktop-shortcut Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Process created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe "C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe" -config.uri=https://ugm3-msn.iwin.com/ -config.channel="20000009" -config.sku="FIRST_INSTALL" -config.iwinrequest="PF/1735198334008948550/zengems/51/0" Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe "C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe" --type=renderer --no-sandbox --service-pipe-token=97A7B1777A421674542AF2780F1B6D7A --lang=en-US --lang=en-US --log-file="C:\Users\user\AppData\Local\GamesManager_iWin_MSN\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPI" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=97A7B1777A421674542AF2780F1B6D7A --renderer-client-id=2 --mojo-platform-channel-handle=2712 /prefetch:1 Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe "C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe" --type=renderer --no-sandbox --service-pipe-token=4AB44524C71BE879F241E5F9C60EF896 --lang=en-US --lang=en-US --log-file="C:\Users\user\AppData\Local\GamesManager_iWin_MSN\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPI" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=4AB44524C71BE879F241E5F9C60EF896 --renderer-client-id=3 --mojo-platform-channel-handle=3168 /prefetch:1 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: libcef.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: chrome_elf.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: cryptui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: d3d9.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dxva2.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: audioses.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: mmdevapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: twinapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: libcef.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: chrome_elf.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: cryptui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: d3d9.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dxva2.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: libcef.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: chrome_elf.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: cryptui.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: d3d9.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dxva2.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Section loaded: wkscli.dll
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: MSN Games Manager.lnk.5.dr LNK file: ..\..\..\..\..\..\Local\GamesManager_iWin_MSN\GamesManager.exe
Source: MSN Games Manager.lnk0.5.dr LNK file: ..\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe
Source: MSN Games Notifier.lnk.6.dr LNK file: ..\..\..\..\..\Local\Programs\MSN-Games-Notifier\MSN Games Notifier.exe
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File written: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\languagestrings.ini Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MSN Games Manager Jump to behavior
Source: file.exe Static PE information: certificate valid
Source: Binary string: fkadialhk.dllacpiz.dllactivedetect32.dllactivedetect64.dllairfoilinject3.dllakinsofthook32.dllassistant_x64.dllavcuf64.dllavgrsstx.dllbabylonchromepi.dllbtkeyind.dllcmcsyshk.dllcmsetac.dllcooliris.dllcplushook.dlldockshellhook.dlleasyhook32.dllesspd.dllgoogledesktopnetwork3.dllfwhook.dllguard64.dllhookprocesscreation.dllhookterminateapis.dllhookprintapis.dllimon.dllicatcdll.dllicdcnl.dllioloHL.dllkloehk.dlllawenforcer.dlllibdivx.dlllvprcinj01.dllmadchook.dllmdnsnsp.dllmoonsysh.dllmpk.dllnpdivx32.dllnpggNT.desnpggNT.dlloawatch.dllpastali32.dllpavhook.dllpavlsphook.dllpavshook.dllpavshookwow.dllpctavhook.dllpctgmhk.dllpicrmi32.dllpicrmi64.dllprntrack.dllprotector.dllradhslib.dllradprlib.dllrapportnikko.dllrlhook.dllrooksdol.dllrndlpepperbrowserrecordhelper.dllrpchromebrowserrecordhelper.dllr3hook.dllsahook.dllsbrige.dllsc2hook.dllsdhook32.dllsguard.dllsmum32.dllsmumhook.dllssldivx.dllsyncor11.dllsystools.dlltfwah.dllwblind.dllwbhelp.dllwindowsapihookdll32.dllwindowsapihookdll64.dllwinstylerthemehelper.dll\*::OpenProcessToken(::GetCurrentProcess(), TOKEN_QUERY, &token)../../content/common/sandbox_win.cc::GetTokenInformation(token, TokenSessionId, &session_id, sizeof(session_id), &session_id_length)\Sessions\%lu%lsProcess.Sandbox.FlagOverrodeRemoteSessionCheck\??\pipe\chrome.*\\.\pipe\chrome.nacl.*\\.\pipe\chrome.sync.**.pdbProcess.Sandbox.Launch.WarningResultCodeProcess.Sandbox.Launch.Warning\Device\DeviceApiFileYou are attempting to duplicate a privileged handle into a sandboxed process. source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: D:\Jenkins\workspace\client3.exe.iwininstaller\ugmtooliwininstallerexe\bin\exe\iWinInstaller.pdb source: GamesManager.exe, 00000007.00000003.3293582074.0000000002E06000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: XInput1_3.pdb source: toasterinstaller.exe, 00000006.00000003.3242267684.0000000003670000.00000004.00001000.00020000.00000000.sdmp, toasterinstaller.exe, 00000006.00000003.3242095039.00000000034B0000.00000004.00001000.00020000.00000000.sdmp, toasterinstaller.exe, 00000006.00000003.3242309069.0000000002EE0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Jenkins\workspace\client3.exe.iwinlauncher\ugmtooliwinlauncherexe\bin\exe\iWinLauncher.pdb source: GamesManager.exe, 00000007.00000003.3293772599.00000000032C1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: XInput1_3.pdb@ source: toasterinstaller.exe, 00000006.00000003.3242267684.0000000003670000.00000004.00001000.00020000.00000000.sdmp, toasterinstaller.exe, 00000006.00000003.3242095039.00000000034B0000.00000004.00001000.00020000.00000000.sdmp, toasterinstaller.exe, 00000006.00000003.3242309069.0000000002EE0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Jenkins\workspace\client3.exe.unifiedgamesmanager\ugmexe\bin\exe\UnifiedGamesManager.pdb source: GamesManager.exe, 00000007.00000002.3453951158.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp, GamesManager.exe, 00000007.00000000.3289003515.0000000000D1B000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: D:\Jenkins\workspace\client3.exe.iwinprerequisites\ugmtoolprerequisites\bin\exe\iWinPrerequisitesAdmin.pdb source: GamesManager.exe, 00000007.00000003.3293940425.00000000032C1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Jenkins\workspace\client3.exe.iwininstaller\ugmtooliwininstallerexe\bin\exe\iWinInstaller.pdb7 source: GamesManager.exe, 00000007.00000003.3293582074.0000000002E06000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Jenkins\workspace\client3.exe.iwinprerequisites\ugmtoolprerequisites\bin\exe\iWinPrerequisitesUser.pdb source: GamesManager.exe, 00000007.00000002.3458594645.00000000032D0000.00000004.00000020.00020000.00000000.sdmp
Binary contains a suspicious time stamp
Source: d3dcompiler_47.dll.5.dr Static PE information: 0xE0FD53C1 [Fri Aug 12 15:20:33 2089 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00405CFF GetModuleHandleA,LoadLibraryA,GetProcAddress, 0_2_00405CFF
PE file contains sections with non-standard names
Source: chrome_elf.dll.5.dr Static PE information: section name: .crthunk
Source: chrome_elf.dll.5.dr Static PE information: section name: CPADinfo
Source: libcef.dll.5.dr Static PE information: section name: _text32
Source: libcef.dll.5.dr Static PE information: section name: .rodata
Source: libcef.dll.5.dr Static PE information: section name: .crthunk
Source: libcef.dll.5.dr Static PE information: section name: _RDATA
Source: libcef.dll.5.dr Static PE information: section name: CPADinfo
Source: pepflashplayer.dll.5.dr Static PE information: section name: .rodata
Source: ffmpeg.dll.6.dr Static PE information: section name: .rodata
Source: MSN Games Notifier.exe.6.dr Static PE information: section name: .rodata
Source: MSN Games Notifier.exe.6.dr Static PE information: section name: _RDATA
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_00C70FC6 push ecx; ret 7_2_00C70FD9
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE7CCB6 push ecx; ret 7_2_6CE7CCC9
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE7B966 push ecx; ret 7_2_6CE7B979
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_00C70FC6 push ecx; ret 9_2_00C70FD9
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_10789933 push ecx; ret 9_2_107899B4
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_10786C20 push ecx; ret 9_2_10786C95
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_1078A40A push edx; ret 9_2_1078A40B
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_10786CE0 push ecx; ret 9_2_10786DA9
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_1078A4C0 push ebx; ret 9_2_1078A537
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_10786CB9 push ecx; ret 9_2_10786DA9
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_1078A5EC push eax; ret 9_2_1078A5F2
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_1078A66C push eax; ret 9_2_1078A672
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_1E1BCFC9 push ecx; ret 9_2_1E1BCFE2
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_1E194C21 push esi; ret 9_2_1E194C23
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_1E187532 push ecx; ret 9_2_1E1875A0
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_1E187566 push ecx; ret 9_2_1E1875A0
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_1E1CDAC0 push ecx; ret 9_2_1E1CDB35
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_1E18ABA8 push esi; ret 9_2_1E18ABAA
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_1E1BE044 push ecx; ret 9_2_1E1BE073
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_1E187060 push ecx; ret 9_2_1E187137
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_1E1BE0E6 push ecx; ret 9_2_1E1BE15C
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_1E1BD1C8 push esi; ret 9_2_1E1BD23A
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 11_2_1EF87532 push ecx; ret 11_2_1EF875A0
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 11_2_1EFCDAC0 push ecx; ret 11_2_1EFCDB35
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 11_2_1EF97E94 push esi; ret 11_2_1EF97E98
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 11_2_1EFBCFC9 push ecx; ret 11_2_1EFBCFE2
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 11_2_1EF8ABA8 push esi; ret 11_2_1EF8ABAA
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 11_2_1EFBE0E6 push ecx; ret 11_2_1EFBE15C
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 11_2_1EF87060 push ecx; ret 11_2_1EF87137
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 11_2_1EFBE044 push ecx; ret 11_2_1EFBE073
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 11_2_1EF94C21 push esi; ret 11_2_1EF94C23
Source: ffmpeg.dll.6.dr Static PE information: section name: .text entropy: 6.838970814942025
Drops PE files
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe File created: C:\Users\user\AppData\Local\Programs\MSN-Games-Notifier\d3dcompiler_47.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\iWinUpgrader.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe File created: C:\Users\user\AppData\Local\Programs\MSN-Games-Notifier\ffmpeg.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\Temp\nsv9448.tmp\INetC.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe File created: C:\Users\user\AppData\Local\Programs\MSN-Games-Notifier\libEGL.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\d3dcompiler_47.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\iWinInstaller.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\Firewall.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\Temp\nskAA62.tmp\INetC.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\iWinPrerequisitesAdmin.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe File created: C:\Users\user\AppData\Local\Temp\nsk1D3F.tmp\nsis7z.dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe File created: C:\Users\user\AppData\Local\Programs\MSN-Games-Notifier\xinput1_3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\pepflashplayer.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\iWinPrerequisitesUser.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe File created: C:\Users\user\AppData\Local\Temp\nsk1D3F.tmp\WinShell.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe File created: C:\Users\user\AppData\Local\Temp\nsk1D3F.tmp\nsProcess.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\NSISdl.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe File created: C:\Users\user\AppData\Roaming\MSN Games Notifier\installer.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\Uninstaller.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\libEGL.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe File created: C:\Users\user\AppData\Local\Programs\MSN-Games-Notifier\node.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe File created: C:\Users\user\AppData\Local\Programs\MSN-Games-Notifier\MSN Games Notifier.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\System.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe File created: C:\Users\user\AppData\Local\Programs\MSN-Games-Notifier\Uninstall MSN Games Notifier.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\browser_cef_dll.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\Temp\nskAA62.tmp\System.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe File created: C:\Users\user\AppData\Local\Programs\MSN-Games-Notifier\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\chrome_elf.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\Temp\nskAA62.tmp\nsProcess.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\browser_cef_exe.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe File created: C:\Users\user\AppData\Local\Temp\nsk1D3F.tmp\StdUtils.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\libcef.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\iWinLauncher.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe File created: C:\Users\user\AppData\Local\Temp\nsk1D3F.tmp\System.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File created: C:\Users\user\AppData\Local\Temp\gm_installation_inner.log Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe File created: C:\Users\user\AppData\Local\Programs\MSN-Games-Notifier\LICENSE.electron.txt Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE55996 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,_wcsrchr, 7_2_6CE55996
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Stores large binary data to the registry
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E Blob Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 2605 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\MSN-Games-Notifier\d3dcompiler_47.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\iWinUpgrader.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\MSN-Games-Notifier\ffmpeg.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsv9448.tmp\INetC.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\MSN-Games-Notifier\libEGL.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\d3dcompiler_47.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\iWinInstaller.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\Firewall.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nskAA62.tmp\INetC.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\iWinPrerequisitesAdmin.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsk1D3F.tmp\nsis7z.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\MSN-Games-Notifier\xinput1_3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\pepflashplayer.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\iWinPrerequisitesUser.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsk1D3F.tmp\WinShell.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsk1D3F.tmp\nsProcess.dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\NSISdl.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\Uninstaller.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\libEGL.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\MSN-Games-Notifier\node.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\MSN-Games-Notifier\MSN Games Notifier.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\System.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\MSN-Games-Notifier\Uninstall MSN Games Notifier.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nskAA62.tmp\System.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\browser_cef_dll.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\MSN-Games-Notifier\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\browser_cef_exe.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nskAA62.tmp\nsProcess.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsk1D3F.tmp\StdUtils.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\iWinLauncher.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsk1D3F.tmp\System.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe API coverage: 4.3 %
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe API coverage: 1.2 %
Sleep loop found (likely to delay execution)
Source: C:\Users\user\Desktop\file.exe Thread sleep count: Count: 2605 delay: -10 Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe File Volume queried: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\20000009\webdata\Cache FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00405302 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 0_2_00405302
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00405CD8 FindFirstFileA,FindClose, 0_2_00405CD8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0040263E FindFirstFileA, 0_2_0040263E
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Code function: 4_2_00406301 FindFirstFileW,FindClose, 4_2_00406301
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Code function: 4_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 4_2_00406CC7
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Code function: 5_2_00402E18 FindFirstFileW, 5_2_00402E18
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Code function: 5_2_00406436 FindFirstFileW,FindClose, 5_2_00406436
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Code function: 5_2_00406DFC DeleteFileW,CloseHandle,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 5_2_00406DFC
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Code function: 6_2_0040287E FindFirstFileW, 6_2_0040287E
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Code function: 6_2_00406427 FindFirstFileW,FindClose, 6_2_00406427
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Code function: 6_2_004058D5 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 6_2_004058D5
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE97409 FindFirstFileExA, 7_2_6CE97409
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE9E7E9 VirtualQuery,GetSystemInfo, 7_2_6CE9E7E9
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File opened: C:\Users\user\Documents\desktop.ini Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File opened: C:\Users\user\AppData\Local\Temp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File opened: C:\Users\user\AppData\Local Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe File opened: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: kGearway Electronics (Dong Guan) Co., Ltd.INGENICOSharp Corp.VMMobile Disk IIIBluetooth 2.0 adapter 100m CN-521v2 001 Backpack 40GB Hard DriveWG121(v1) 54 Mbps Wireless [Intersil ISL3886]USA-18X PDAInternal Keyboard/Trackpad (JIS)Nostromo 1745 GamePadPX-A650 [Stylus CX4700/CX4800/DX4800/DX4850]Savi Office Base Stationremote key/mouse/storage for P3 chipPhotoSmart 7345VMware Inc.ASUSTek Computer, Inc.MindShare, Inc.GDS-3000 OscilloscopePL512 Power Supply SystemG240 802.11bgWL-188 Wireless Network 300N USB AdapterBackPackWG121(v2) 54 Mbps Wireless [Intersil ISL3886]USA-28Xb PDA [no firmware]Aluminum Mini Keyboard (ANSI)Nostromo N50 GamePadPM-A750 [Stylus Photo RX520/RX530]USB DSP v4 Audio Interfaceremote storage for P3 chipDeskJet 630c
Source: GamesManager.exe, 00000007.00000002.3461793997.0000000004465000.00000002.00000001.00040000.00000022.sdmp Binary or memory string: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAAFwklEQVR4XuVb208cVRgftYm+eYkv3hofjMY3fdPEGB/8E4wmJkoL0pLWWIha8GnbIixFWrvEitxauRQpsLDLZUHALnR3Z8ultaa4zOyKxoTEB6NpKrNnZ84wx/Ptw6SlLOzlnNmZcJJfstmZPXN+33znfNcVeA5CyAOhNbI/KunviTJ2i7LuE+P6zbCs/SVKGgpL2iYAPsN3cA3uicRxvZjQ311MGM8JDhtA+sGIrL1JSTSLcbxGSZGCIOHf6DyeqKS9AXPblri4YjwRies1lPjvmciwEAZ9RnXoT/K4bYgvS+RJSrqRqrICBKxAOK5tiDJuAKEXjXgwSPbRt3GMEr8NBIoCWftXlPWPBwh5yFLyUdl4mRJYoiB2AH0R18KrxkuWkKcPK4VTGwjYCektKOslXFVelPF5IGBngPVhviWCf5BHREkfAwJOAPgSsGZm5COSPm0ScI4QpmDtBau9+eadiZGCtoO5550MGZ/Lj3xcLzMJOByRhP5Bznaer6mz3kQuxIwXs9/3/J0c6yHp0azMI7i3PAkEf8Wk66pGzoyr5NRwCpD+3B3SyBy9xtljPLJrYMPLt59dwcQ9qpIDrUnyYcv2OEivNdB7rqxgXkHUPztGkhDV8SB/OaqR8nYEJLPC4Q5EBq5hXp5iXcZ4nkdI2xfRyIHvgFhugN/0iRoHIWj/UQfpse32fg1r8oGbmJSZKp87ytqSJPAL5uElfn5fGotHJqemHwGRgvBFP+JgFnHinvQa5PBYkx9ewkCACXxLmL0QEtrrdx9+zawfcHpUZSaAxjGVvUmU8VkzdW1mbxmisgcxE0BVD+JgEbAkwIC8PQ9zU9rGgrx5GPLxC1aNpwUoWvCYvCSj6cvLJPLyCd6BkNfNY/JDHey2wKFOxMk9xrUCpI94TF79AzsB1FxGvGIDrwD1OB6TfzPNzgp8O63yihBvCFCU5DH5zC1MDjI4ByBAmuUXHK0LPBMfZyYK14KzkyrPRElSgPI0rweEJB1seN7kP+1FdJFcM0WbXAUAmKVb4ZOu3IVQ2Y1M1ecqACtyf5DpOTmcypo8ZInmYtiSXKF5CFoB7yImrqEUHGz3kQbP8QS95s0Q+PA6BE0zaCVgX/uXMSQ80vBfx+nvirCO66YjtCch6UMQCtfvRfKmKwzdWHuRvBkMQSvaXhXAfMx4SoAB3VeWSFzWyfQtnE5x9Ysa6Qmlkf48sozT7nPEMguAY3cVQrGHOVmK8Z8xab+iknpfilT1IjB/Wfn+cG+dP0XagyqZuMHLLOImUwDQhMjqDUMRxE0XX3GBXThc0YnonCoZiGJ4Bhs3Pa69dk9aHPKChbi7nikVFgoEuAIE2/yjSn4qwE0OyzgOudCthZHqnF3cGIaIz1RtKwGeI0SK86t5aepnwtYBRUPowMySPKijqebFxJGLiAwu5KIN2p3lNfJoppaYhizIw8FmJj3tAFhL55yatfOzY8MztJ/uRL47rJESIGAzwJouRbRdLJP2t1kYzQTovd2puaHczPbaD1BWn4vtWBQ9LOw2oI0kHNcXMqg+ELAxMm8Fyimc9f8NoPEY8mVbJgH7bncBQE1y254AMWG8kGOPoF6ydSKX1/4COOVNbacB7+fZGY6bHS8AcHnzHXAeQMLEsQKQ9UHY94V3isv6lMMEAMFYIBA3HmbWMQ6Nx04RALx5JuS3bgdqBa7aXQANfiXI9T9Ebl/qfFnrhmE34rCm0/6kR7BiNE/ityt7lDt2IV/Vm7z99Qx+S7ByuAjZV+dDfeVtxdOG8g5l80tfqttU+WKgZRI97/KiMKigdequGCeH0bwnaDwr2GWcm0nurx1Rx45e3NB4ET96QVFrh5P+llnjGVv/ebppQv3INYSWYcEFk/5eSbkG0WJTAJWaaSwnwRNQX20YRU0nhlDoeF9qvbI7qVR0KHppqwKJjDTgM3x3rEtRjl9C63Cvewx91TiuvsKbwP/OVp2D40M/7QAAAABJRU5ErkJggg==) 1x,
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: @%WINDIR%\system32\wlanapi.dllWlanOpenHandleWlanEnumInterfacesWlanQueryInterfaceWlanSetInterfaceWlanFreeMemoryWlanCloseHandleVMnetGetAdaptersAddresses failed: ../../net/base/network_interfaces_win.ccsource_dependency
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: VMware Fusion 4 has corrupt rendering with Win Vista+
Source: GamesManager.exe, 00000007.00000002.3457869406.0000000003119000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll9"
Source: file.exe, 00000000.00000003.2780114048.00000000006E2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: VMnet
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: yuv420pyuyv422rgb24bgr24yuv422pyuv444pyuv410pyuv411pgray8,y8monowmonobpal8yuvj420pyuvj422pyuvj444pxvmcmcxvmcidctuyvy422uyyvyy411bgr8bgr4bgr4_bytergb8rgb4rgb4_bytenv12nv21argbabgrgray16bey16begray16ley16leyuv440pyuvj440pyuva420pvdpau_h264vdpau_mpeg1vdpau_mpeg2vdpau_wmv3vdpau_vc1rgb48bergb48lergb565bergb565lergb555bergb555lebgr565bebgr565lebgr555bebgr555levaapi_mocovaapi_idctvaapi_vldyuv420p16leyuv420p16beyuv422p16leyuv422p16beyuv444p16leyuv444p16bevdpau_mpeg4dxva2_vldrgb444lergb444bebgr444lebgr444beya8gray8abgr48bebgr48leyuv420p9beyuv420p9leyuv420p10beyuv420p10leyuv422p10beyuv422p10leyuv444p9beyuv444p9leyuv444p10beyuv444p10leyuv422p9beyuv422p9levda_vldgbrpgbrp9begbrp9legbrp10begbrp10legbrp16begbrp16leyuva422pyuva444pyuva420p9beyuva420p9leyuva422p9beyuva422p9leyuva444p9beyuva444p9leyuva420p10beyuva420p10leyuva422p10beyuva422p10leyuva444p10beyuva444p10leyuva420p16beyuva420p16leyuva422p16beyuva422p16leyuva444p16beyuva444p16levdpauxyz12lexyz12benv16nv20lenv20bergba64bergba64lebgra64bebgra64leyvyu422vdaya16beya16legbrapgbrap16begbrap16leqsvmmald3d11va_vldcuda0rgbrgb00bgrbgr0yuv420p12beyuv420p12leyuv420p14beyuv420p14leyuv422p12beyuv422p12leyuv422p14beyuv422p14leyuv444p12beyuv444p12leyuv444p14beyuv444p14legbrp12begbrp12legbrp14begbrp14leyuvj411pbayer_bggr8bayer_rggb8bayer_gbrg8bayer_grbg8bayer_bggr16lebayer_bggr16bebayer_rggb16lebayer_rggb16bebayer_gbrg16lebayer_gbrg16bebayer_grbg16lebayer_grbg16beyuv440p10leyuv440p10beyuv440p12leyuv440p12beayuv64leayuv64bevideotoolbox_vldp010lep010begbrap12begbrap12legbrap10begbrap10lemediacodecgray12bey12begray12ley12legray10bey10begray10ley10lep016lep016bereservedgbrrgb32bgr32vaapiValue %f for parameter '%s' out of range [%g - %g]
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: VMware, Inc.
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: VMware Inc.
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: xvmcidct
Source: GamesManagerInstaller.exe, 00000004.00000003.2792537522.00000000007B1000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000002.3454139613.000000000079E000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000003.2792537522.00000000007C4000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000003.2792766491.000000000079E000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000003.2792537522.000000000079E000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000002.3454139613.00000000007C4000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000003.2792766491.00000000007B1000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000003.2792766491.00000000007C4000.00000004.00000020.00020000.00000000.sdmp, GamesManagerInstaller.exe, 00000004.00000002.3454139613.00000000007B1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: GamesManagerInstaller.exe, 00000004.00000003.2786421468.000000000079E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllg
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: vmnet
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: Qemu Audio Device
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: kEADS Deutschland GmbHVMware, Inc.AGFA-Gevaert NVPhoto AIO Printer 922Sentech CameraEyeTV DiversityPSX Vibration Feedback ConverterGamtec.,Ltd SmartJoy PLUS AdapterCruzer MiniMC70 Rugged Mobile ComputerXR21V1410 USB-UART ICCanoScan D660UCatalinaExpert mouseCLOCK USB II
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: kTMT Technology, Inc.Spyrus, Inc.Qemu Audio DeviceWL532U 802.11g Adapter8055 Experiment Interface Board (address=2)PicoScope 2000 series PC OscilloscopeFrontline Test Equipment Bluetooth DeviceAVerTVEfficient ADSL ModemVS-700 M23D Optical MouseDigital IXUS 55WingMan Formula ForceRemote NDIS Network DeviceHDM Interface
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B62A000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: ckThe Intel Mobile 945 Express family of chipsets is not compatible with WebGLNVIDIA GeForce FX Go5200 is assumed to be buggyDrivers older than 2009-01 on Windows are possibly unreliableS3 Trio (used in Virtual PC) is not compatibleParallels drivers older than 7 are buggyATI FireMV 2400 cards on Windows are buggyThe Intel GMA500 is too slow for Stage3DNVidia driver 8.15.11.8593 is crashy on WindowsHardware video decode is only supported in win7+6.1VMware Fusion 4 has corrupt rendering with Win Vista+NVIDIA driver 8.17.11.9621 is buggy with Stage3D baseline modeNVIDIA driver 8.17.11.8267 is buggy with Stage3D baseline modeAll Intel drivers before 8.15.10.2021 are buggy with Stage3D baseline modeNVIDIA GeForce 6200 LE is buggy with WebGLGPU access is blocked if users don't have proper graphics driver installed after Windows installationAccelerated video decode interferes with GPU sandbox on older Intel driversDisable GPU on all Windows versions prior to and including VistaIntel Graphics Media Accelerator 3150 causes the GPU process to hang running WebGLAccelerated video decode on Intel driver 10.18.10.3308 is incompatible with the GPU sandboxAccelerated video decode on AMD driver 13.152.1.8000 is incompatible with the GPU sandboxAccelerated video decode interferes with GPU sandbox on certain AMD driversAccelerated video decode interferes with GPU sandbox on certain NVIDIA driversAccelerated video decode does not work with the discrete GPU on AMD switchablesIntel driver version 8.15.10.1749 causes GPU process hangs.GPU rasterization should only be enabled on NVIDIA and Intel DX11+, and AMD RX-R2 GPUs for now.Some AMD drivers have rendering glitches with GPU RasterizationGPU rasterization is blacklisted on NVidia Fermi architecture for now.GPU Rasterization is disabled on pre-GCN AMD cardsMSAA and depth texture buggy on Adreno 3xx, also disable WebGL2Disable use of D3D11/WebGL2 on Windows Vista and lowerDisable D3D11/WebGL2 on older nVidia driversDisable use of D3D11/WebGL2 on Matrox video cardsDisable use of D3D11/WebGL2 on older AMD driversOld Intel drivers cannot reliably support D3D11/WebGL2Disable D3D11/WebGL2 on AMD switchable graphicsgpu-gl-context-is-virtual
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: kCONNECTION_UNKNOWNCONNECTION_ETHERNETCONNECTION_WIFICONNECTION_2GCONNECTION_3GCONNECTION_4GCONNECTION_NONECONNECTION_BLUETOOTHCONNECTION_INVALIDTeredo Tunneling Pseudo-InterfacevmnetNotifyObserversOfIPAddressChangeImplNotifyObserversOfConnectionTypeChangeImplNotifyObserversOfNetworkChangeImplNotifyObserversOfDNSChangeImplNotifyObserversOfMaxBandwidthChangeImpl
Source: file.exe, 00000000.00000003.2743271907.0000000000736000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B8AF000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: VMware Screen Codec / VMware Video
Source: C:\Users\user\Desktop\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_00C76C9B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 7_2_00C76C9B
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00405CFF GetModuleHandleA,LoadLibraryA,GetProcAddress, 0_2_00405CFF
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_00C81D5E mov eax, dword ptr fs:[00000030h] 7_2_00C81D5E
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_00C8AF71 mov eax, dword ptr fs:[00000030h] 7_2_00C8AF71
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE85F63 mov eax, dword ptr fs:[00000030h] 7_2_6CE85F63
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_00C81D5E mov eax, dword ptr fs:[00000030h] 9_2_00C81D5E
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_00C8AF71 mov eax, dword ptr fs:[00000030h] 9_2_00C8AF71
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_00C70162 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 7_2_00C70162
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_00C76C9B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 7_2_00C76C9B
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE72EC9 SetUnhandledExceptionFilter, 7_2_6CE72EC9
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE7CE19 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 7_2_6CE7CE19
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE81567 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 7_2_6CE81567
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE7C24C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 7_2_6CE7C24C
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_00C70162 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 9_2_00C70162
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 9_2_00C76C9B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 9_2_00C76C9B
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe "C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe" --type=renderer --no-sandbox --service-pipe-token=97A7B1777A421674542AF2780F1B6D7A --lang=en-US --lang=en-US --log-file="C:\Users\user\AppData\Local\GamesManager_iWin_MSN\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPI" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=97A7B1777A421674542AF2780F1B6D7A --renderer-client-id=2 --mojo-platform-channel-handle=2712 /prefetch:1 Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe "C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe" --type=renderer --no-sandbox --service-pipe-token=4AB44524C71BE879F241E5F9C60EF896 --lang=en-US --lang=en-US --log-file="C:\Users\user\AppData\Local\GamesManager_iWin_MSN\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; Win32; x86) Chromium/61.0.0.0 Chrome/61.0.0.0 Version/3.9.6.635 GamesManager/3.9.6.635 20000009 WinVer/10.0 [x64] CEF/3.3163.1651.gf229796 UAPI" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=4AB44524C71BE879F241E5F9C60EF896 --renderer-client-id=3 --mojo-platform-channel-handle=3168 /prefetch:1 Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe "c:\users\user\appdata\local\temp\nsjaa08.tmp\gamesmanagerinstaller.exe" -installer.createiwinshortcuts=yes -config.channel=20000009 -config.uri=https://ugm3-msn.iwin.com/ -config.channelname=msnstreaming -config.iwinrequest="pf/1735198334008948550/zengems/51/0"
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Process created: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe "c:\users\user\appdata\local\temp\gminstaller\gamesmanagerinstaller.exe" -installer.logstartsent=true -config.channel=20000009 -config.uri="https://ugm3-msn.iwin.com/" -config.channelname="iwin" -config.sku=first_install -installer.createshortcutswithname="msn games manager" -autoupdate=1 -config.iwinrequest="pf/1735198334008948550/zengems/51/0"
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe "c:\users\user\appdata\local\gamesmanager_iwin_msn\gamesmanager.exe" --type=renderer --no-sandbox --service-pipe-token=97a7b1777a421674542af2780f1b6d7a --lang=en-us --lang=en-us --log-file="c:\users\user\appdata\local\gamesmanager_iwin_msn\debug.log" --user-agent="mozilla/5.0 (windows nt 10.0; win32; x86) chromium/61.0.0.0 chrome/61.0.0.0 version/3.9.6.635 gamesmanager/3.9.6.635 20000009 winver/10.0 [x64] cef/3.3163.1651.gf229796 uapi" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=97a7b1777a421674542af2780f1b6d7a --renderer-client-id=2 --mojo-platform-channel-handle=2712 /prefetch:1
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe "c:\users\user\appdata\local\gamesmanager_iwin_msn\gamesmanager.exe" --type=renderer --no-sandbox --service-pipe-token=4ab44524c71be879f241e5f9c60ef896 --lang=en-us --lang=en-us --log-file="c:\users\user\appdata\local\gamesmanager_iwin_msn\debug.log" --user-agent="mozilla/5.0 (windows nt 10.0; win32; x86) chromium/61.0.0.0 chrome/61.0.0.0 version/3.9.6.635 gamesmanager/3.9.6.635 20000009 winver/10.0 [x64] cef/3.3163.1651.gf229796 uapi" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=4ab44524c71be879f241e5f9c60ef896 --renderer-client-id=3 --mojo-platform-channel-handle=3168 /prefetch:1
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe "c:\users\user\appdata\local\temp\nsjaa08.tmp\gamesmanagerinstaller.exe" -installer.createiwinshortcuts=yes -config.channel=20000009 -config.uri=https://ugm3-msn.iwin.com/ -config.channelname=msnstreaming -config.iwinrequest="pf/1735198334008948550/zengems/51/0" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsjAA08.tmp\GamesManagerInstaller.exe Process created: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe "c:\users\user\appdata\local\temp\gminstaller\gamesmanagerinstaller.exe" -installer.logstartsent=true -config.channel=20000009 -config.uri="https://ugm3-msn.iwin.com/" -config.channelname="iwin" -config.sku=first_install -installer.createshortcutswithname="msn games manager" -autoupdate=1 -config.iwinrequest="pf/1735198334008948550/zengems/51/0" Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe "c:\users\user\appdata\local\gamesmanager_iwin_msn\gamesmanager.exe" --type=renderer --no-sandbox --service-pipe-token=97a7b1777a421674542af2780f1b6d7a --lang=en-us --lang=en-us --log-file="c:\users\user\appdata\local\gamesmanager_iwin_msn\debug.log" --user-agent="mozilla/5.0 (windows nt 10.0; win32; x86) chromium/61.0.0.0 chrome/61.0.0.0 version/3.9.6.635 gamesmanager/3.9.6.635 20000009 winver/10.0 [x64] cef/3.3163.1651.gf229796 uapi" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=97a7b1777a421674542af2780f1b6d7a --renderer-client-id=2 --mojo-platform-channel-handle=2712 /prefetch:1 Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Process created: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe "c:\users\user\appdata\local\gamesmanager_iwin_msn\gamesmanager.exe" --type=renderer --no-sandbox --service-pipe-token=4ab44524c71be879f241e5f9c60ef896 --lang=en-us --lang=en-us --log-file="c:\users\user\appdata\local\gamesmanager_iwin_msn\debug.log" --user-agent="mozilla/5.0 (windows nt 10.0; win32; x86) chromium/61.0.0.0 chrome/61.0.0.0 version/3.9.6.635 gamesmanager/3.9.6.635 20000009 winver/10.0 [x64] cef/3.3163.1651.gf229796 uapi" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=4ab44524c71be879f241e5f9c60ef896 --renderer-client-id=3 --mojo-platform-channel-handle=3168 /prefetch:1 Jump to behavior
Source: GamesManager.exe, 00000007.00000002.3478924965.000000006B999000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: iProgmanApplicationFrameWindowWindows.UI.Core.CoreWindowqG
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE7CAC5 cpuid 7_2_6CE7CAC5
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW, 7_2_6CE9AD40
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: EnumSystemLocalesW, 7_2_6CE9AFB8
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: GetLocaleInfoW, 7_2_6CE9AF0F
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: EnumSystemLocalesW, 7_2_6CE92AB6
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 7_2_6CE9B4A4
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: GetLocaleInfoW, 7_2_6CE9B5AB
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 7_2_6CE9B678
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: EnumSystemLocalesW, 7_2_6CE9B09E
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: EnumSystemLocalesW, 7_2_6CE9B003
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: GetLocaleInfoW, 7_2_6CE9301B
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 7_2_6CE9B12B
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: GetLocaleInfoW, 7_2_6CE9B37B
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GMInstaller\GamesManagerInstaller.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\toasterinstaller.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_6CE76F55 GetVersion,CreateNamedPipeW, 7_2_6CE76F55
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Code function: 7_2_00C7136A GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 7_2_00C7136A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004059FF GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA, 0_2_004059FF
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Adds / modifies Windows certificates
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E Blob Jump to behavior

Stealing of Sensitive Information
barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js Jump to behavior
Source: C:\Users\user\AppData\Local\GamesManager_iWin_MSN\GamesManager.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1522706 Sample: file.exe Startdate: 30/09/2024 Architecture: WINDOWS Score: 57 58 d370k74vusd53r.cloudfront.net 2->58 60 p.iwin.com 2->60 70 Suricata IDS alerts for network traffic 2->70 72 Antivirus / Scanner detection for submitted sample 2->72 74 Multi AV Scanner detection for submitted file 2->74 76 2 other signatures 2->76 10 file.exe 1 23 2->10         started        signatures3 process4 dnsIp5 66 d370k74vusd53r.cloudfront.net 18.245.31.40, 49730, 80 AMAZON-02US United States 10->66 48 C:\Users\user\AppData\Local\...\System.dll, PE32 10->48 dropped 50 C:\Users\user\AppData\Local\...50SISdl.dll, PE32 10->50 dropped 52 C:\Users\user\...behaviorgraphamesManagerInstaller.exe, PE32 10->52 dropped 14 GamesManagerInstaller.exe 30 10->14         started        file6 process7 dnsIp8 68 52.2.184.42 AMAZON-AESUS United States 14->68 54 C:\Users\user\AppData\Local\...\INetC.dll, PE32 14->54 dropped 56 C:\Users\user\...behaviorgraphamesManagerInstaller.exe, PE32 14->56 dropped 18 GamesManagerInstaller.exe 12 124 14->18         started        file9 process10 file11 32 C:\Users\user\AppData\...behaviorgraphamesManager.exe, PE32 18->32 dropped 34 C:\Users\user\AppData\Local\...\nsProcess.dll, PE32 18->34 dropped 36 C:\Users\user\AppData\Local\...\System.dll, PE32 18->36 dropped 38 17 other files (none is malicious) 18->38 dropped 21 GamesManager.exe 1 52 18->21         started        25 toasterinstaller.exe 13 124 18->25         started        process12 dnsIp13 62 68.232.35.54 EDGECASTUS United States 21->62 64 107.23.182.116 AMAZON-AESUS United States 21->64 78 Tries to harvest and steal browser information (history, passwords, etc) 21->78 28 GamesManager.exe 1 21->28         started        30 GamesManager.exe 21->30         started        40 C:\Users\user\AppData\...\installer.exe, PE32 25->40 dropped 42 C:\Users\user\AppData\Local\...\nsis7z.dll, PE32 25->42 dropped 44 C:\Users\user\AppData\Local\...\nsProcess.dll, PE32 25->44 dropped 46 12 other files (none is malicious) 25->46 dropped file14 signatures15 process16
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
107.23.182.116
 unknown United States
14618 AMAZON-AESUS false
18.245.31.40
 d370k74vusd53r.cloudfront.net United States
16509 AMAZON-02US true
68.232.35.54
 unknown United States
15133 EDGECASTUS false
52.2.184.42
 unknown United States
14618 AMAZON-AESUS false

Contacted Domains

Name IP Active
d370k74vusd53r.cloudfront.net 18.245.31.40 true
p.iwin.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://ugm3-msn.iwin.com/ugm.appcache false
    		unknown
    https://play.iwincdn.com/assets/site/ajax-loader-2-62916463ab77e7f2aea4f13eee7b21c1801a6997cd15f90dd18135539bbc414d.gif false
      		unknown
      https://play.iwincdn.com/assets/ugm3-msn_iwin_com/logo-loading-c6983a12a93990ab7e6d5224d41eea343f5188fdb4649e36bb1c2a43b0e8b5d9.png false
        		unknown
        https://ugm3-msn.iwin.com/ true
          		unknown