b16a273e67fa4f3c8bf811d365b29e0c09044f7f83c0fe999d0d7557f44a8f44

Analysis

max time kernel
115s
max time network
138s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/10/2024, 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
Size

2.1MB
MD5

24d9ad48991aa15f62b964f3a8030560
SHA1

7ea6e5655bf709efd324f2c9715321d5bfc72629
SHA256

b16a273e67fa4f3c8bf811d365b29e0c09044f7f83c0fe999d0d7557f44a8f44
SHA512

406a0a6aa4a7638e65d7d87bb04ab81220a1bb7be44687d4652bd94ccf761990a231eac973bb0af8b664e1195654404addc9352056ae75bd0f421ff4190d06f4
SSDEEP

49152:Q4G2IVejKGyQdj2EWwU/2XoxIsh+Gm3WGaPcC:Q4GDVcKxEPUeYbh7mK1

Score

7^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3000	gamevance32.exe

Loads dropped DLL 4 IoCs

pid	Process
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
2960	cmd.exe
3000	gamevance32.exe
3004	regsvr32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Gamevance = "C:\\Program Files (x86)\\Gamevance\\gamevance32.exe a"	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0ED403E8-470A-4a8a-85A4-D7688CFE39A3}\NoExplorer = "1"	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{beaC7DC8-E106-4C6A-931E-5A42E7362883}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\ = "Gamevance Text"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\NoExplorer = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0ED403E8-470A-4a8a-85A4-D7688CFE39A3}	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0ED403E8-470A-4a8a-85A4-D7688CFE39A3}\ = "Gamevance"	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Gamevance\ars.cfg	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Gamevance\ars.cfg	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
File created	C:\Program Files (x86)\Gamevance\gvtl.dll	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
File created	C:\Program Files (x86)\Gamevance\icon.ico	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
File created	C:\Program Files (x86)\Gamevance\gvff.tmp	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
File created	C:\Program Files (x86)\Gamevance\gamevancelib32.dll	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
File created	C:\Program Files (x86)\Gamevance\gamevance32.exe	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
File created	C:\Program Files (x86)\Gamevance\gvun.exe	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Gamevance\ars.cfg	gamevance32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gamevance32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	gamevance32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	gamevance32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	gamevance32.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	gamevance32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	gamevance32.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000db66d92b7f6340d1310e8bc84750d51b1eef3112035d98f91dae592e7f72c5d9000000000e8000000002000020000000bb4d1e85b94ae717ae75d95b797ea4f915cd824011500f503080f238efa653b920000000a2953de94176cc379b1ebbece78991124e329c5b4990bb2e019fa219097adfe4400000008fc35b77edd110fd17a03f4c73bca8a54fc2a6131609955fe127a94d6675bacabf4ff548a55a8ea9e8bcb4a9192307463fe5a60530466f465d297fcf5541c518	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434600253"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{44E3E041-85E0-11EF-AD26-C60424AAF5E1} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000ecb42c33568fa6e6a78c51f011f17da841876a9edf050a267db8a008ebc48350000000000e8000000002000020000000731d5a2234023fce0b6a822fc4b2853039d2b47e06b991bb4d95c073a2d0a750900000008a0844a64c240687a8e8894dba67a5d62167b233ebb763700027888615d20e8285d4102d84b03ee772151818f9aca22c10c3b44ab13a7b4cb77bc31eb47db9bf0d8e772eaba1a31dfdc06dd6f778ce73337ebed717d958574c8984d3a929f2f099be611fc7339ba54a93df4f7794a9b579917bbdfd51663846e048023b914cf1b8e513262e59743a43f744aa075286184000000031f5c433c477e6252827b0a65ce8c3481149ea42333780eb6d210e743d0f1fc1da0a12ff914c46a09cbacf0af737147e11e1b2d8423841d6ffa15843d40e8a2a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f01c091aed19db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Modifies registry class 31 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker\ = "Gamevance Text"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GamevanceText.DLL\AppID = "{beaC7DC8-E106-4C6A-931E-5A42E7362883}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0ED403E8-470A-4a8a-85A4-D7688CFE39A3}\ = "Gamevance"	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\InprocServer32\ = "C:\\Program Files (x86)\\Gamevance\\gvtl.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0ED403E8-470A-4a8a-85A4-D7688CFE39A3}\InprocServer32\ = "C:\\Program Files (x86)\\Gamevance\\gamevancelib32.dll"	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker.1\ = "Gamevance Text"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0ED403E8-470A-4a8a-85A4-D7688CFE39A3}\InprocServer32	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\ProgID\ = "GamevanceText.Linker.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\TypeLib\ = "{014C4232-6904-47B9-9144-7E0FB7277444}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GamevanceText.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GamevanceText.DLL\ = "GamevanceText"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\ = "Gamevance Text"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0ED403E8-470A-4a8a-85A4-D7688CFE39A3}\InprocServer32\ThreadingModel = "Apartment"	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0ED403E8-470A-4a8a-85A4-D7688CFE39A3}	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker.1\CLSID\ = "{beaC7DC8-E106-4C6A-931E-5A42E7362883}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker\CLSID\ = "{beaC7DC8-E106-4C6A-931E-5A42E7362883}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker\CurVer\ = "GamevanceText.Linker.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\VersionIndependentProgID\ = "GamevanceText.Linker"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
3000	gamevance32.exe
3000	gamevance32.exe
3000	gamevance32.exe
3000	gamevance32.exe
3000	gamevance32.exe
3000	gamevance32.exe
3000	gamevance32.exe
3000	gamevance32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2992	iexplore.exe
2992	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2960	1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe	29
PID 1972 wrote to memory of 2960	1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe	29
PID 1972 wrote to memory of 2960	1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe	29
PID 1972 wrote to memory of 2960	1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe	29
PID 2960 wrote to memory of 3000	2960	cmd.exe	31
PID 2960 wrote to memory of 3000	2960	cmd.exe	31
PID 2960 wrote to memory of 3000	2960	cmd.exe	31
PID 2960 wrote to memory of 3000	2960	cmd.exe	31
PID 1972 wrote to memory of 1776	1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe	32
PID 1972 wrote to memory of 1776	1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe	32
PID 1972 wrote to memory of 1776	1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe	32
PID 1972 wrote to memory of 1776	1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe	32
PID 1776 wrote to memory of 3004	1776	cmd.exe	34
PID 1776 wrote to memory of 3004	1776	cmd.exe	34
PID 1776 wrote to memory of 3004	1776	cmd.exe	34
PID 1776 wrote to memory of 3004	1776	cmd.exe	34
PID 1776 wrote to memory of 3004	1776	cmd.exe	34
PID 1776 wrote to memory of 3004	1776	cmd.exe	34
PID 1776 wrote to memory of 3004	1776	cmd.exe	34
PID 1972 wrote to memory of 2992	1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe	36
PID 1972 wrote to memory of 2992	1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe	36
PID 1972 wrote to memory of 2992	1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe	36
PID 1972 wrote to memory of 2992	1972	24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe	36
PID 2992 wrote to memory of 2740	2992	iexplore.exe	37
PID 2992 wrote to memory of 2740	2992	iexplore.exe	37
PID 2992 wrote to memory of 2740	2992	iexplore.exe	37
PID 2992 wrote to memory of 2740	2992	iexplore.exe	37

C:\Users\Admin\AppData\Local\Temp\24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\24d9ad48991aa15f62b964f3a8030560_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\Program Files (x86)\Gamevance\gamevance32.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Program Files (x86)\Gamevance\gamevance32.exe
    "C:\Program Files (x86)\Gamevance\gamevance32.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c regsvr32.exe /s "C:\Program Files (x86)\Gamevance\gvtl.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\Gamevance\gvtl.dll"
    3⤵
    - Loads dropped DLL
    - Installs/modifies Browser Helper Object
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3004
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.gamevance.com/aj/ty.php?p=srKz%2F8uywsH0srLM8%2Fm16bG17fXA4dvG%2F7C3urG7tLO7urrBwbGwxrT%2Fo%2F%2Bzs7Oys7Ozs%2F%2FMyA
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2992 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Gamevance\ars.cfg

Filesize
107B

MD5
70c8bf8198820f65c29d1d50dd7ac8f1

SHA1
7a29b1beb7ae9dea971e72ebcf3a2d05b9508b01

SHA256
57f733444033bbc56a785cacb51f0208aa82da410abd57df04e72f459380bb96

SHA512
f6396d1abf0003f4438329e0b98a38855a4d45b65523bb55991198b24c175fc66d2bbb67bd6a102b6f5f84e79847a4ced5710d6e0d18a8978f1a4bcbee7e5f37

Download Submit
C:\Program Files (x86)\Gamevance\ars.cfg

Filesize
163B

MD5
b3a77207537ada4c37b8f39861d2d17a

SHA1
315afc636ef004dc042e15da14d97f448473ae8d

SHA256
d287581b8181ebcd3861c430888144518db5d34d2c3ea0721d7a24794fd42807

SHA512
d0f08e940a43ed7e4f629910973d147cb5683178f06dff042bbdecc94fd67ef43e85bc1cf5d94d454aa76a165fd9a449ef4e433894f7e0ff7e99e33d97537abd

Download Submit
C:\Program Files (x86)\Gamevance\gvtl.dll

Filesize
261KB

MD5
c427707b9344e09d49c80b8f8a1d9571

SHA1
807cd2d0cc5260169199c57ecb7140aebe7468aa

SHA256
38b4ccfc04a6680bc14435ee6bc873fefb31c6c4011802f40d72a80c49207ef9

SHA512
8eefed29d857dffcf41258dc50f6bd1275ba7a6799f05b3315696196b6cd0c7f304aa1e4c84e8dfa742489a1ebb5f1a56b21fc7ca3336d57aa8db14e766741ca

Download Submit
C:\Program Files (x86)\Gamevance\gvun.exe

Filesize
266KB

MD5
57fed70b01c086a69227dfe36e1a37e5

SHA1
b5c389677b10d64888128cd7b06baeaead78be53

SHA256
cf577720eac582caba9c03f8ddb7f3fe43f2eec9286b5f280aec4ccf5c3c9d20

SHA512
2fb0675cd41775097ddd0c294078e258962ac4681732e27e2a0a143f05c543696e6839300d563540db2b72051506f4287698ec5474fd4c2f77fda91bb324e90a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
229d719f7e83097764d877974c1ea9e6

SHA1
a8bdd25cad551db9d19f2099d862fba511a1c56b

SHA256
a5de017c96a27b9f672404542b00eca84da855336961b115c324f41a6c26130c

SHA512
2d98824829d803a8174f673f7e6d9ad4997b042331449f8077b277419e683affbf51725f27caba06bc099867aff4c724f4887be5ea6b6c96b37b92d602ae767a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b95e55b2a433414ea1e7486761b58e1b

SHA1
da9eb6b4ee0f599ad1ee365307abd4104f4650a4

SHA256
d8972ac9a67261d718ab4f7aa4a1ccc9aa8926c53dfe9e8da8a396b95f9cb392

SHA512
84559084f4d94ea3d6ec1e6ae88ba9bb7944d77f82c857f9fe4da511d6198d00e8e4ba8bbceb16f8c7af6f4eda768b2700deb7a3f26d0fcc43d96470d37df024

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65b6903f1319146cd27f780fc74fd0b6

SHA1
15e312434d95d60a4d4ff4662468ebb7f0ce3931

SHA256
a02e7e8fae1760b3ab13bd1cdfda3c6e2bbcd724bb4a8ea2a593d342fa7bb669

SHA512
12b677de4a6f0726ba18b60ade17573056776587f15170ae6b4719209e75b87f9928c23fb008c1b55451af65b8d4fedd6bbc1ef2061d5f4cbb916a4068d08520

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8dd4adbcf70c6c5ebf7d2d10f93b329d

SHA1
071b7fc90526ae1aea27e674916de0b57effc65f

SHA256
0d89b90cdbd5e92786cf824e23ee9a9fa3b2b2ad9ee6d81338259320f8a7f7f7

SHA512
25e6629f3256672b4552f0a12fbac8c51a9514e1dc56bd10206b7950e4e463bba4d5bb34c5583c1a747f12bda3f4cad4934569de3339bd6fa4c74efefe2a803d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0dd8deb232a357b7d683b0898cd9b8d6

SHA1
4a6aadb5c560526931faed0d46e1c6bcb0dd0d5c

SHA256
1c5888823969ed918b00040481935f5872a1d6f94feb88f9552917acc677bf18

SHA512
7b53f700536db1dd92cd5fb7fe24ed748327017c933ca38f4f67ccddc1ab47f24b81bc45edc7b6417603c78433c73f4e6278737b9de601084130cc29579aebe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b0467ee71c98cd7b84526ae5eeb1730

SHA1
64f1f40fff3861193ce5d843cb001086d1ff3ecb

SHA256
cc5e6a4b17724fe2cd5e09eb13db0a900c30274898eaa844cf35075c3c8f59a5

SHA512
9c679cd43754e675f4ae8d384185a65a23254aa9747497a1c0d39d8bead5134179af1b942928efae367b60a3544b74cc42cf985267c7704e8480dceec8a7bb94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21b359d7964be5cef693552f9fae1a88

SHA1
9c8bb11cf2f24d1af31ac2ce12f7b2719a96c9d2

SHA256
2d0c6804fe0967a133296f07d4c4856389d994d1c0521b9e5ec183f8cd05482f

SHA512
8710fe5976acba481525ddec8cb323738456391635b211a79f52cad0554b92fcc64f61bdfdf73abd0d564f75b7994fb3284e2ec385540cae740818323925cf5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
620ce7cf8a960c078386c63bedbcadf7

SHA1
72c0fcdee730f21058c47b4f1488c51d71706db7

SHA256
733470abe0d7c4e0e827359364a4dcf296f7cde7c068284ca81da1701e5cbbc6

SHA512
0974de020c4a4b9e36e7131b4de08b8ab7b3a41e2129157b39d7151aec8f7b121efbdfb296e63240dd82171f353c7f188c3c060d3cce5d821fd49c44707cbf16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
895cec70efb7836778e35fe0bd25eb4e

SHA1
8eacf56b17785043c49988f28db12c74563339e6

SHA256
84c1445879b810da0c04a52e3cb9fc5d4955a5887945017f5f2a76f95f873eff

SHA512
c5dd5866af62f583fbc1a5752662c190cb71713a83b5d16ebdb550fe1c7d5492fac311940f9351824a801d7434ec4a1ca2bd56adc21fde229fe2db16787e8f31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5296759c61fbbab67099063a62f18cdc

SHA1
2f1db4c1fb422e1b66958a92f9b98a174969d119

SHA256
5d759fdcf2e3c69c3aff103ccc32dfa395c4a78021613b5480eab0d5256037ae

SHA512
e670170d034d8e1a3887535770b889e09192fb21ec394becab5ed87a233576a0ec81634c2174010e212b443a0d1418f1852d3bc32ba845a265af19220ef19d79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5da22dce601431f7716d315f894b1c0

SHA1
c1328c538af2f3d5e2481aff31f163678171e7e1

SHA256
e604e12038da620bf56ef97451b63332896b91b591b239d9a8c7b3f04b18e131

SHA512
8c5f637ec16f4aaa440130a449b9fa2f3dbf5339fed48d8ceb3ef143e8fd2aacd3ce8c650accf9108522b5b47771f20e98a75044d207d4e20d74346a0d4f7707

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7dd9fcb828d5327b3bf3079737d12fb5

SHA1
2f59188a7b4ad149364cc9ff99135f604f40bdbc

SHA256
884228b3c2bb614b9f80c6491c1d14722ab921a6ced9f6259792a0d14c62e99b

SHA512
59ca152d786a3b837e068cf646a05a94ec5eac75d2334e73988c4aef5ad17a38dd619bb56d5c1ac623d22d62a714ba78e58716a3d2259a5ade8b11c745b897a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb7c5e7fb0672639e383d390fb18d950

SHA1
1cc7f146b3258fca9f1b4d195ad4d118741c1d65

SHA256
98eeb0bf7ada193c1897112634e06b2a0432947d569407928a14d5aafe4c1b1c

SHA512
b364435e8f59d0e7e13119a50b4f76bdce7cda172809865d4a0d219fbc05d08a46cca3bb4122f39255f8316a90967ae88f78c8a102add321c56e12b5275d4ef7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
460b6837446c9e9808d9f6d647dbda09

SHA1
79993ef2cd8a747f14d137256b67f733c5b60657

SHA256
bfd63831c34864645ba751a13f7d6aa4d83a876614e77297ebcc38b60ca7feb5

SHA512
fbf31e0adc8e684290a878dd7713b317e3c457be39ab4cd52dbda72dfec36760a7597ff6c0b356b6b0cda7e032fb85cb69f92957f1fa91e2d99976877deab368

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a22fa912c2080cb82a450490fdedc56

SHA1
2b4130cb838ffb20f9e4e57c9236cffe79681fea

SHA256
a3384f5be9810e023deadce6125fce60fd5168176c333177534cc1b81b1078cd

SHA512
56da8cecdf5be0529bd61a61c269346e739c1ef1c8a2c8cfb038eeeb206b010e1c363d2865c5e76c75a7b62111c7254c6d487fef6379cc9424ee93db31b80a05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61b86e442b3f5fc378fc95d88e8e0252

SHA1
5a7687caa470f867dcc7421ba2bdd9ca89e12f3b

SHA256
fd3dd2b03b1a3f54227ec21a5122d730f5fb76e85c4baabc6d9c897fcc77237a

SHA512
20700f4c5801546bc856a9186e663da2d73f8bea6736460958b64c71f147275dc52400247dc572ab48463d28427e62a72369e78bf048109f6aec633e6b637a86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f07c040937c3e1a21e6e34bf8b0c368

SHA1
04b87638cf031a24d797f6f52912d7426c33566f

SHA256
0d740c04e4bf3d6b6327f0b789b2f4962ad382bbe208f202f74fa36bc0ebcc40

SHA512
f0be8fea3f6e81df9d897394e26f25552a7eb552c9305d6658a708622d21fd1e6feae8eb75635ad64115c865cef36350477e0201c53e8682e739831d6d082f85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c6707fec8f025913c56a89baa86f5ea

SHA1
166725003f28497ee575eb21e09789aefe3f6a05

SHA256
86356181be1e5f99e8c36d773136a90c96b52aaf355bcf3fd4a272f08982cb8d

SHA512
c88bb97c52d19714cbe8e7872f83547531bd65e34df271757e3646f00740e6b0f0653af9e717a18f9a78682c0dbe566cce80a32773732e56c0731c5a8aae1bf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76deb00f597580e0a45a5fa30ad50fbc

SHA1
6e7c445b32f4596a41b6bd4eb5d6a2b3eef7d314

SHA256
594b246117a265d85567aef240e5d38b7bcc3a8be4f83ca19cd9e9146fb624c5

SHA512
b441f953701f328c3dc1c0837c369333ee1c237d93f49b451b1405eb6955098e9f73328e0f66e863e363574485de2fda9e4a287366896583c3f78704a5a72bce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52cb43b029f9d789b09c0741dc85ba8f

SHA1
a89e5fdc99f6a0970f10ec5cd5033b3cb74cb5c4

SHA256
d8f4426c3865ede7b9b589f47bb7d51c00a05e61d3fb8fdf38df53b126d1365d

SHA512
f6436fa615d5a53671e447992d7dcff751e5839f85f51b71387693196eb41deb84a8e6bd47ce1df0b898dc8981a2d1eda401f9e3d9d0cf53de3c131f9c19945a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c43988ffb6f909cc10db3de5d4e80da8

SHA1
e721c08554273020042778e502ba867fa5b563b0

SHA256
66ed1c3ec748fbabfb638986d01df91297d2039bd9fff30d24a816c9b778955d

SHA512
44feacbd02897accd789e2e7c34a894894d9fed3663e68d1e3eafb819031040abbe85c4664edfe55de961d114ac3dd3396cfc86d7ed5d57ec093c6fd636146f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fee1126d2e7a3036522e49defd90fd32

SHA1
27ed7b4405291129d64b293f1f69b064a5908472

SHA256
ea786c36d0e9bb0134e46a9605b35ce90b2f976018f907e0099cc90bd11a86e6

SHA512
1f37493acdf77a4c1114ba18aad52a990da5fc98a061138a5f8e49a1ed957e0b36401871c903a76809db202e579a817d5948b9cdc34c262ad31bfd13efcd1075

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b3dec582b33c103a59c483840e4ac48

SHA1
3749bf9b73aa29e9aa20466a151163e0c587a7b0

SHA256
e87890387d4cf8e6e0fc7846941f9066a5d825a061e836ad3bef0bf552b8a1f7

SHA512
56699e640abe9ade30f2d418723770d232298a81b1ae08007e4dc05045738df673a5d62f8fa12375dd97fa3ad24aebada28ac4105b5fb23101f74fc1c7e93a26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a39af719029230395a69d92bcba0ef26

SHA1
07da4bbfa8eb9300c14f98e283dccd972fed6d1b

SHA256
b4e1a1ca5a9961ccd62de9fd816db51fdb097f456daf8c20497d31246ebf402e

SHA512
c752718173696c2b96cc86733fdb0f78adb3109e3e0bf8f77cdc0b1b4c6910e46786a3b2af40ad2c5c048f7093efb4de979b779b23393b1af16c89f541861d61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6EBD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6F1E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Program Files (x86)\Gamevance\gamevance32.exe

Filesize
235KB

MD5
d89eb83f947515a3976e03a7b262f19c

SHA1
0a2acfcb6b4cc8c25a8cd067707289f926842757

SHA256
b1fd11afc5e8dad7bb6f825d8c8ffce36b513bbe7ce42fad1ab8cc465c4c1baa

SHA512
fdfc7aeaad7df3f24472658a2edf926108d59077a8e47c64edc39a11fb40f1949c1f0ecfb941b7015b86a2a8830b7e408022f2f7bbb49d653fe9ef667213e1aa

Download Submit
\Program Files (x86)\Gamevance\gamevancelib32.dll

Filesize
229KB

MD5
098df591b91a91c49540ac9040ce151e

SHA1
75049097f1c33b63c91c243851bba4db897d4b8a

SHA256
4bf4c12ec9fb1c2d7ea48da37c6a3b86e0715bedf812f0fbc485b3e97def6240

SHA512
6359424c9878b85aaa6771a2ee403274398a484e7b6a23a3388b00f740ec7457bef4a57783c654f4fa8ea0900e8a8d4e9f84fecf0daaad4eb1300cc0c5d521f6

Download Submit