Malware Analysis Report

2025-08-05 23:33

Sample ID 250119-x1k6sssmej
Target JaffaCakes118_d0ad32489cb94443b7c441d455a267d3
SHA256 4b8e02e55cbd79b06a6e34dac839cc7f60cec7f5199ad65f1478d9594a164f22
Tags
adware discovery persistence spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

4b8e02e55cbd79b06a6e34dac839cc7f60cec7f5199ad65f1478d9594a164f22

Threat Level: Shows suspicious behavior

The file JaffaCakes118_d0ad32489cb94443b7c441d455a267d3 was found to be: Shows suspicious behavior.

Malicious Activity Summary

adware discovery persistence spyware stealer

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Checks installed software on the system

Installs/modifies Browser Helper Object

Adds Run key to start application

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Browser Information Discovery

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Modifies registry class

Modifies Internet Explorer settings

Suspicious use of SendNotifyMessage

Enumerates system info in registry

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-19 19:19

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-19 19:19

Reported

2025-01-19 19:21

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Gamevance\gamevance32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Gamevance = "C:\\Program Files (x86)\\Gamevance\\gamevance32.exe a" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A

Checks installed software on the system

discovery

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{beaC7DC8-E106-4C6A-931E-5A42E7362883} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\ = "Gamevance Text" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\NoExplorer = "1" C:\Windows\SysWOW64\regsvr32.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Gamevance\ars.cfg C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
File created C:\Program Files (x86)\Gamevance\gamevance32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
File opened for modification C:\Program Files (x86)\Gamevance\ars.cfg C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
File created C:\Program Files (x86)\Gamevance\gvff.tmp C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
File created C:\Program Files (x86)\Gamevance\gvtl.dll C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
File created C:\Program Files (x86)\Gamevance\gamevancelib32.dll C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
File created C:\Program Files (x86)\Gamevance\gvun.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
File opened for modification C:\Program Files (x86)\Gamevance\ars.cfg C:\Program Files (x86)\Gamevance\gamevance32.exe N/A
File created C:\Program Files (x86)\Gamevance\icon.ico C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Gamevance\gamevance32.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Program Files (x86)\Gamevance\gamevance32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Gamevance\gamevance32.exe N/A
Key created \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
Key created \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Gamevance\gamevance32.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Gamevance\gamevance32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct C:\Program Files (x86)\Gamevance\gamevance32.exe N/A
Key created \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GamevanceText.DLL C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker.1 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker.1\ = "Gamevance Text" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker.1\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker.1\CLSID\ = "{beaC7DC8-E106-4C6A-931E-5A42E7362883}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker\ = "Gamevance Text" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\WOW6432Node\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\ProgID\ = "GamevanceText.Linker.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\VersionIndependentProgID\ = "GamevanceText.Linker" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GamevanceText.DLL\ = "GamevanceText" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker\CurVer C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker\CLSID\ = "{beaC7DC8-E106-4C6A-931E-5A42E7362883}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\ = "Gamevance Text" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GamevanceText.DLL\AppID = "{beaC7DC8-E106-4C6A-931E-5A42E7362883}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker\CurVer\ = "GamevanceText.Linker.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\ProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\VersionIndependentProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\Programmable C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\InprocServer32\ = "C:\\Program Files (x86)\\Gamevance\\gvtl.dll" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\TypeLib\ = "{014C4232-6904-47B9-9144-7E0FB7277444}" C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4832 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe C:\Windows\SysWOW64\cmd.exe
PID 4832 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe C:\Windows\SysWOW64\cmd.exe
PID 4832 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 1616 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Gamevance\gamevance32.exe
PID 2740 wrote to memory of 1616 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Gamevance\gamevance32.exe
PID 2740 wrote to memory of 1616 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Gamevance\gamevance32.exe
PID 4832 wrote to memory of 3624 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe C:\Windows\SysWOW64\cmd.exe
PID 4832 wrote to memory of 3624 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe C:\Windows\SysWOW64\cmd.exe
PID 4832 wrote to memory of 3624 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe C:\Windows\SysWOW64\cmd.exe
PID 3624 wrote to memory of 1432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 3624 wrote to memory of 1432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 3624 wrote to memory of 1432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4832 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 1448 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 1448 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 4060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 1952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 1952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 1952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 1952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 1952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 872 wrote to memory of 1952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c "C:\Program Files (x86)\Gamevance\gamevance32.exe"

C:\Program Files (x86)\Gamevance\gamevance32.exe

"C:\Program Files (x86)\Gamevance\gamevance32.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c regsvr32.exe /s "C:\Program Files (x86)\Gamevance\gvtl.dll"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe /s "C:\Program Files (x86)\Gamevance\gvtl.dll"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.gamevance.com/aj/ty.php?p=srKz%2F8T1wsH0srLSyejP2bvG2tKz69TV%2F8awtbHGx7CyxsGwscHGscf%2Fo%2F%2Bzs7Ozs7Ozs%2F%2FMyA

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9849a46f8,0x7ff9849a4708,0x7ff9849a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,11301500919249426917,10519722718235322093,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,11301500919249426917,10519722718235322093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,11301500919249426917,10519722718235322093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11301500919249426917,10519722718235322093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11301500919249426917,10519722718235322093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,11301500919249426917,10519722718235322093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,11301500919249426917,10519722718235322093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11301500919249426917,10519722718235322093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11301500919249426917,10519722718235322093,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4392 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11301500919249426917,10519722718235322093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11301500919249426917,10519722718235322093,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,11301500919249426917,10519722718235322093,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4608 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 www.gamevance.com udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 76.223.54.146:80 www.gamevance.com tcp
US 8.8.8.8:53 146.54.223.76.in-addr.arpa udp
US 8.8.8.8:53 www.gamevance.com udp
US 13.248.169.48:80 www.gamevance.com tcp
US 13.248.169.48:80 www.gamevance.com tcp
US 13.248.169.48:80 www.gamevance.com tcp
US 8.8.8.8:53 151.50.22.2.in-addr.arpa udp
US 8.8.8.8:53 167.173.78.104.in-addr.arpa udp
US 8.8.8.8:53 48.169.248.13.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 181.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 61.153.16.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 6.173.189.20.in-addr.arpa udp

Files

memory/4832-0-0x0000000000400000-0x0000000000788000-memory.dmp

memory/4832-1-0x0000000000400000-0x0000000000788000-memory.dmp

C:\Program Files (x86)\Gamevance\gamevancelib32.dll

MD5 cf0d4026b83380d4f7431b65ac7e8200
SHA1 764531d73634f375e6e6ac0f122f47bdb691b315
SHA256 40292b911d69fb981956ff4eb04469207656774c52b495124fe06379236d78fc
SHA512 86a513a4e87ec1d721f6d957e383bccae82235b02b6f048b5f5d474d189c8f7cedc4f2e792174f6054a28aa8b112b4de77cda3d1dfc2eb614390072e67380abe

memory/4832-12-0x0000000067000000-0x0000000067044000-memory.dmp

C:\Program Files (x86)\Gamevance\ars.cfg

MD5 912e4eed4381adb9c64ee177ba6aa7ed
SHA1 bdeb17831f237adaa5105ba50558cdf7803b0d06
SHA256 2aef5c710664a0b9080e7c7aa260987ded2d8c3bc89f81b020762129dabc8407
SHA512 735076084990d3bfdcd66d679b0a7d9be3eed6c933fed27acdd120867c6ba45addd8b09764468e8779e475e31d20b499725dc3cafb965b24ba77836d59fe9f10

C:\Program Files (x86)\Gamevance\gamevance32.exe

MD5 cbdc88d81ee9b4853dae7bdb410bea8e
SHA1 5cf9c38a2e535cc6ba91a081c861a09f3845312c
SHA256 7eb8769e1a66005a1f163f477e08927aaca665198ec231d8267d254f87e6ec38
SHA512 1377a164af6ff4189b338ce7369c57b4a199cfd11f47698015a1034025f5a671f46d97a46ac43a9c6df98b31b1d00788da1b0a8440fdb0b3c2e5f5f8b7be9aab

C:\Program Files (x86)\Gamevance\ars.cfg

MD5 62ce0562bceff443bd79c41ca8535864
SHA1 80589fd72973b39ddd26e6461c4c70171125e586
SHA256 c161ec6f362c614ef1d1a29a8d361ee893c60f007ba1174f416fd997bb87d64e
SHA512 3f5d420dda6da2eaa99926ad96c6d5d6a76c460ee59c157c5dcc6e74f9b64d9015a33394e62f841a71e355ad0cd0d31f89a1b4fbe83303ec8f174d128ea6f7c1

memory/1616-39-0x0000000067000000-0x0000000067044000-memory.dmp

memory/1616-40-0x0000000000400000-0x000000000044E000-memory.dmp

C:\Program Files (x86)\Gamevance\ars.cfg

MD5 c2c08b049ccf6c8707829c0365caa76d
SHA1 f456a238d093d9923ad701c4da2f56e0d7482fd1
SHA256 0b0266e01f6a10d23fe5eb133079e3eaa34473c174a84e4edb07a2b8e2d605b7
SHA512 a5e6966838dc29ee376fcfc0e2ee5857fad750bc726bec32c5d7bc67e2e761c9bc47e4e161021a1d2a4c31e50e0c47eea85e0e6cd49d2870a56f4b14056aee77

C:\Program Files (x86)\Gamevance\gvun.exe

MD5 46db06cb8465b7e58e01b8f1d24ee1f7
SHA1 152f92ce634b4f23e0480f7f6c9ad36128c9a903
SHA256 559b8c3f3781a2494cd24d6dbc6fa0577cc44483b9442e4d33716c1cd25bd1dc
SHA512 45453facb647e410edbf136f8e0156c1c7803263394566e8bb5620f364c18c8f7571523f40119aa3ab925e4b8c306eda4738fc357915736caed8232df244ccf6

memory/4832-41-0x0000000000400000-0x0000000000788000-memory.dmp

memory/1616-62-0x0000000000400000-0x000000000044E000-memory.dmp

C:\Program Files (x86)\Gamevance\gvtl.dll

MD5 c6ecec4f180f5cf57a13e338015dc0a2
SHA1 dfab483824956bddd46e61b5f6db3536fcc0ac64
SHA256 ae939f3c64886fe24081c1070e3a7eaf04f2864db451e682efd1ff5cf546d007
SHA512 a878b12487e5062441e2f23c7a72f9eec23e590e80db60c9c6c03e270e7e6283c951663adf7212ecbd649bdabf62b09ce1ae827b4d0b0a54c924aa129ebda72d

memory/4832-82-0x0000000000400000-0x0000000000788000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 37f660dd4b6ddf23bc37f5c823d1c33a
SHA1 1c35538aa307a3e09d15519df6ace99674ae428b
SHA256 4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
SHA512 807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

\??\pipe\LOCAL\crashpad_872_RTIXYMDSZJHWFKDB

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 d7cb450b1315c63b1d5d89d98ba22da5
SHA1 694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA256 38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
SHA512 df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 579e3c14764729baaa38502ee442fdd4
SHA1 6ab05eb48902c0a521b80f3c934e2b71923f7d91
SHA256 55f8762274d23e40ec1f995efc4dc516443a54cc87a488e9fb67478d2627943d
SHA512 4208beffab889788e00245773c87831bc252e3a0cc51c1340246e4449bf8a5f0b774b09b55c9ae0d14561b1206033c8b09fdef1fa80b6f142c9c1c16b30469bd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 4dab44342ff97326065457ba4f1048ee
SHA1 eeba6fa592a7edfae13aeade5dc96cf5159b9727
SHA256 708b917b7f586b7f5a160018be2fb04801ca4c51b4fc4cceabee2020afe79c8a
SHA512 1c0098ac9f5c642a4b4cde8cb32bb8e77f52299204bb7a572b960f38f1f83fb8c6361bca84a4d9b8f592cca91fea2d882c68dd60015ef718438e636a5dab78a0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 982edb08193d4c1f11d0c2b198eea5f1
SHA1 cb93e7bffa633284a5e999a85b10c2e315305f44
SHA256 c8690f104e78b4dff7614c0761e4e7caa39d65a9b80628ea4c23d6381db37528
SHA512 bdba65760cc349bf95a442e8c27c1aecc5758d22cf28a7e8c3d7e30c15e344b471deb17627c0fb450daea0129656ebbec1eaa01e856c88bf4176b744b5a480cb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-19 19:19

Reported

2025-01-19 19:21

Platform

win7-20240903-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Gamevance\gamevance32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Gamevance = "C:\\Program Files (x86)\\Gamevance\\gamevance32.exe a" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A

Checks installed software on the system

discovery

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{beaC7DC8-E106-4C6A-931E-5A42E7362883} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\ = "Gamevance Text" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\NoExplorer = "1" C:\Windows\SysWOW64\regsvr32.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Gamevance\ars.cfg C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
File opened for modification C:\Program Files (x86)\Gamevance\ars.cfg C:\Program Files (x86)\Gamevance\gamevance32.exe N/A
File created C:\Program Files (x86)\Gamevance\icon.ico C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
File created C:\Program Files (x86)\Gamevance\gvtl.dll C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
File created C:\Program Files (x86)\Gamevance\ars.cfg C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
File created C:\Program Files (x86)\Gamevance\gamevance32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
File created C:\Program Files (x86)\Gamevance\gvun.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
File created C:\Program Files (x86)\Gamevance\gamevancelib32.dll C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
File created C:\Program Files (x86)\Gamevance\gvff.tmp C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Gamevance\gamevance32.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Gamevance\gamevance32.exe N/A
Key created \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
Key created \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Gamevance\gamevance32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Program Files (x86)\Gamevance\gamevance32.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key created \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Gamevance\gamevance32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct C:\Program Files (x86)\Gamevance\gamevance32.exe N/A
Key created \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{596D9C31-D69A-11EF-B9BB-7694D31B45CA} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443476256" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008f948ff715aa4442862a061e494bdf400000000002000000000010660000000100002000000052220052ac946975d1eccdbe5fcd1319b1154721c7d1e39a6ef3dc99eb7eb366000000000e8000000002000020000000a06a1ccea282557b0526b4dd2b27b5c08b7e838499a4b9ea97b867f20ff50d9120000000e2b9a0246518dd42208c5c19185c04ee253dfc52120d98ca253ca7617c6c142240000000b69f4a38be4759de2bbdbd58f376ba33ce5fbc753321ff7d3d9bffb70f338efb250068096773a6fd3c2c4fcdf1e5d6ad19f5ee8d21f41a97d50c090d71693d75 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 902a502ea76adb01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008f948ff715aa4442862a061e494bdf400000000002000000000010660000000100002000000076b0b476f911a9b5fe3c19a581c634ee2c3c2903bd8bf5629ca0753bfc1760c7000000000e8000000002000020000000788a90f19dcdb208f7965fc5f39ac11c58c9777b973c3ffae7ef853c19d114b090000000b5e403d05ddc806464ac78eac2a5f1c161a597e49ec5944a3f7ceeb2fbbb9e1e53d2e35d696c544d4bd28061ee96a6c9790b1dd4a7c01f673da905cc08381ada2b1c4b71b45c305854d9cc4bd364e1671e78caf9a191867941bc3e5d6cb1786073a81efd8265693c9fdc2598cad2048e7fafefe319fe0930b519eaaebc04a1642449205da113a83a4d064573e2154cac40000000415e1c6fbe0f5c0bc3697cc41dc9a880ed1ac1f71298a6432ad607db3a81765b80ef9826828ae11d2227fb9749a289e955c506b8b7a8fd23e61fec2acabbc63b C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker\CurVer C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\VersionIndependentProgID\ = "GamevanceText.Linker" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\ProgID\ = "GamevanceText.Linker.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\Programmable C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\InprocServer32\ = "C:\\Program Files (x86)\\Gamevance\\gvtl.dll" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker.1\ = "Gamevance Text" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker\ = "Gamevance Text" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker.1\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker.1\CLSID\ = "{beaC7DC8-E106-4C6A-931E-5A42E7362883}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker\CurVer\ = "GamevanceText.Linker.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\ProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GamevanceText.DLL\ = "GamevanceText" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GamevanceText.DLL\AppID = "{beaC7DC8-E106-4C6A-931E-5A42E7362883}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker.1 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\VersionIndependentProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\ = "Gamevance Text" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\TypeLib\ = "{014C4232-6904-47B9-9144-7E0FB7277444}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GamevanceText.DLL C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker\CLSID\ = "{beaC7DC8-E106-4C6A-931E-5A42E7362883}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe N/A
N/A N/A C:\Program Files (x86)\Gamevance\gamevance32.exe N/A
N/A N/A C:\Program Files (x86)\Gamevance\gamevance32.exe N/A
N/A N/A C:\Program Files (x86)\Gamevance\gamevance32.exe N/A
N/A N/A C:\Program Files (x86)\Gamevance\gamevance32.exe N/A
N/A N/A C:\Program Files (x86)\Gamevance\gamevance32.exe N/A
N/A N/A C:\Program Files (x86)\Gamevance\gamevance32.exe N/A
N/A N/A C:\Program Files (x86)\Gamevance\gamevance32.exe N/A
N/A N/A C:\Program Files (x86)\Gamevance\gamevance32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2096 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe C:\Windows\SysWOW64\cmd.exe
PID 2096 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe C:\Windows\SysWOW64\cmd.exe
PID 2096 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe C:\Windows\SysWOW64\cmd.exe
PID 2096 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe C:\Windows\SysWOW64\cmd.exe
PID 2504 wrote to memory of 1844 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Gamevance\gamevance32.exe
PID 2504 wrote to memory of 1844 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Gamevance\gamevance32.exe
PID 2504 wrote to memory of 1844 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Gamevance\gamevance32.exe
PID 2504 wrote to memory of 1844 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Gamevance\gamevance32.exe
PID 2096 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe C:\Windows\SysWOW64\cmd.exe
PID 2096 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe C:\Windows\SysWOW64\cmd.exe
PID 2096 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe C:\Windows\SysWOW64\cmd.exe
PID 2096 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2836 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2836 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2836 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2836 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2836 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2836 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2096 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2096 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2096 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2096 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1844 wrote to memory of 2912 N/A C:\Program Files (x86)\Gamevance\gamevance32.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 1640 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2912 wrote to memory of 1640 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2912 wrote to memory of 1640 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2912 wrote to memory of 1640 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1844 wrote to memory of 1640 N/A C:\Program Files (x86)\Gamevance\gamevance32.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0ad32489cb94443b7c441d455a267d3.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c "C:\Program Files (x86)\Gamevance\gamevance32.exe"

C:\Program Files (x86)\Gamevance\gamevance32.exe

"C:\Program Files (x86)\Gamevance\gamevance32.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c regsvr32.exe /s "C:\Program Files (x86)\Gamevance\gvtl.dll"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe /s "C:\Program Files (x86)\Gamevance\gvtl.dll"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://www.gamevance.com/aj/ty.php?p=srKz%2F8T1wsH0srLSyejP2bvG2tKz69TV%2F7HFs7W6t8HHsbu3wcW7tML%2Fo%2F%2Bzs7Oys7Ozs%2F%2FMyA

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.gamevance.com udp
US 76.223.54.146:80 www.gamevance.com tcp
US 13.248.169.48:80 www.gamevance.com tcp
US 76.223.54.146:80 www.gamevance.com tcp
US 76.223.54.146:80 www.gamevance.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/2096-0-0x0000000000740000-0x0000000000AC8000-memory.dmp

memory/2096-1-0x0000000000740000-0x0000000000AC8000-memory.dmp

\Program Files (x86)\Gamevance\gamevancelib32.dll

MD5 dec77b23c96ef47910ab181bf8d187ce
SHA1 78d61fe5b39e43bfd4928c81e04b6cc5690af2c7
SHA256 3835df1dbeb63fc12cea03ec21aff2be87fca0ebe4d94b34ed81dce53a5e10b4
SHA512 a52b4a76f9070179cf0d661b0024755bd974ba7f60981c2c73485e12ab4f50e475c6ab21fa3fdfd17838d3194b615cf0f51db2ebc55e04f4ddd0a9bafaeb08c3

memory/2096-13-0x0000000067000000-0x0000000067044000-memory.dmp

C:\Program Files (x86)\Gamevance\ars.cfg

MD5 a2fcfb394bccd9b23b2465bc2de3817c
SHA1 0eb6a328a0c82d60ea6d5eceb21eab342d5655b4
SHA256 bcae5e13b3aa916dc30978904cb5987a928f127678232020622ff840ca24bd54
SHA512 8373f3f608bdb7a6ea3e4b0ea0bb2187c0d0434ef24904dbf463b0d31db774017904c855ad58aa177e8c6443020b796dd8dc60beac070be6f37ee5e9791201de

\Program Files (x86)\Gamevance\gamevance32.exe

MD5 9b6aab97bc137c4eb4adb0ec6eec66f3
SHA1 5563f5a992ac8b83b907966d035445fea0ce7e58
SHA256 b764b34e426f28478c8c02707bfb353a2ac02da0e31094c45ded6f2da62a789e
SHA512 c08ecbbee0a74a5710ea3ead76360cf429fd65f8daf824e88f28f61c17041d56ffc36266e3fd1a2e105f7f061c1a8e3d2e56c500e98902bb7a967fa5b96dc3ee

memory/1844-37-0x0000000067000000-0x0000000067044000-memory.dmp

C:\Program Files (x86)\Gamevance\ars.cfg

MD5 f9f7b3de340b18aaebb8e464f482812d
SHA1 d26d3af289307503fb000384de20e4972d4537b7
SHA256 db1301f32852b936eefc95220ff96608ed32d6fd1c2234faeca9be4f81e932de
SHA512 e233595dacf82d2d3b726b181f22a0d06f17ff406b6f56d7a61ff03bff36ec73f6abe35b18266b8f73e6d859123cf6d423bcd9d9c2d4879e30b9dd8599c98371

memory/1844-52-0x0000000000080000-0x00000000000CE000-memory.dmp

memory/2096-51-0x0000000000740000-0x0000000000AC8000-memory.dmp

C:\Program Files (x86)\Gamevance\ars.cfg

MD5 7d8e1dfb0ce1de9514405d84b312d0d0
SHA1 4ec4ed10872d10d63b9137ab0369b9ca8b704b1a
SHA256 4c32fd9d3285c3d12862ea0788c5bbf97af1aab36e177053476ed75250eb1098
SHA512 97b7c6c3b33ed822acff32081f3376274ed4869bd7e11246013cd7413f57540aba72b8c8675fed093cf182e292c97898334151e945c1c09b1e7f9a978829d248

memory/1844-61-0x0000000000080000-0x00000000000CE000-memory.dmp

C:\Program Files (x86)\Gamevance\gvun.exe

MD5 13350ee3df4eb30475d6f655b7ce1839
SHA1 9b977ccca2eff1871441862ecb25654d00f5c6f2
SHA256 29b5ac27364c331b249deda4110b4c0e481181a81cf5854c2dcf621220e5178a
SHA512 07f9178fca3746d275eada4c6882d4ccd2c47f3113586bedee47bd07ad29b8aa3e32be93df89ef499479be34f06a5aa80b202381eed339a26aca34d508c4b9e0

C:\Program Files (x86)\Gamevance\gvtl.dll

MD5 c6ecec4f180f5cf57a13e338015dc0a2
SHA1 dfab483824956bddd46e61b5f6db3536fcc0ac64
SHA256 ae939f3c64886fe24081c1070e3a7eaf04f2864db451e682efd1ff5cf546d007
SHA512 a878b12487e5062441e2f23c7a72f9eec23e590e80db60c9c6c03e270e7e6283c951663adf7212ecbd649bdabf62b09ce1ae827b4d0b0a54c924aa129ebda72d

memory/1844-67-0x0000000067000000-0x0000000067044000-memory.dmp

memory/2096-82-0x0000000000740000-0x0000000000AC8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab3A55.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar3AC5.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 229a30203d894db13f5afeb62b5a3189
SHA1 a3a554e278ff8e1eae6249657edf1aadc1bc6408
SHA256 e4929eef04ef64767d845970089413f4e26badf5d851d8772781a34e2b2e247c
SHA512 e818f1873a0f199c4acd9c2bf85e71ed91166a088fca05a7814b39cecc74ee5029b9d1fd4f849171e1c94d29f86c13038923b6eb5699e36e0fe6035dfb575a46

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e6e9f2dd38dc2f1ce259fa95777f738f
SHA1 bf9598f1f9cb0436e889f161bb60f15a4f83f07e
SHA256 f161202ac269c3ae1f6923773fccedb6e2ac156efb49830427bcd932cea20318
SHA512 983975cfb38d8ca70a285b950db7eac77e35fc993e3ad50bb2ee4fa84c9938a6428b6b319fb6e71d3b4983cbca48a13a110a78c8edcb08abcfe9707f0d6296d8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5f26544b5d2879002cbfedc52ce96197
SHA1 461cbecd5e335f90854aec7c71159c3cf5055315
SHA256 c059d40ab464c230ad24806509b1f15b80568f52a6842f4cb4a6e1abd3939593
SHA512 c384edbd04008c053266441b746f67df0eea43b125b33e44e9f0da4b5374fbaa19084825176b561c5065b2e3dd035850af9e574f90e63d7ecaec71975e8448d2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b1ce251c6fd3ce19bd0dfdd41e6f74d1
SHA1 913982a41b0e5cc593560303f932c5b1d0a3b8d3
SHA256 ebb0e25d128c25d4bd65eb3d7d0bfeaf57d71212d915890d13278a7b789bef6a
SHA512 0692488c4f7d5c87c0d8eca10ce2d11e17b73c5d4f20c78bb644a1c3dadfcb8c83f25250c09b070dad3333906b8ca88328cc445a3eda02920c3dc1475905ecbf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2c897600acd771a4936df1cbbebbe177
SHA1 807d7304b8a5d6e671c14928c6cbcb4840ba02cc
SHA256 e2b4d9b9392a95ff76dc9bbf518b7f2ad7a0c5c1f61943ecddcfb9c4b0692ba2
SHA512 d2acad185557c370a51122b4393936ca73dd692a42fbbd3283d68db4f5881f809270183d0710a0cdd5db87ba07bc59ae01f151136dfdb8abfbe97495eed298e3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7118df7f3d91c1b10f4d1383167ee6d2
SHA1 6cd74612e0e97d3d9b8c3e516619275d467400b3
SHA256 a4d2c83e464ad8124dc4da342d1ba40b7c2c557c2bfae347a9a9877fcafaf9d1
SHA512 f15ef5bf838a8ddb137bce513662ad05f5241f2f4fd4f6361e0cbc0eedfe40d151e31f126c4b6097f1e5e4d67e499efa2df9fa8d4c2bb2749b989e4c884d8ff7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6e2a35f97c001beac2fd056be7c06d84
SHA1 369aaeb0c2ad85ddee896e128bce5104119b0ff1
SHA256 2383cc0d1cccf57fd4fc20f6c6431705735ba1c96b8fa05debca0ec7c52359c3
SHA512 813bd8b32d25225c29e5a4495fe1e516dfe67fae2ae292f89c1f8ec5efa9f16dff68d3b7f44a4d4be2c79f41d6ea0124c7ad4923557749e7dd2ad425f88f6784

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0a1eb0eb84d343a51269e188361b668f
SHA1 7cd7bef46a31dbc9af471e2e629e08fb2276c629
SHA256 36328bf1764198499d631245b9e6238c4cbc61beb95e4601971fbde225be2f96
SHA512 59195abada717a50ac51d82ce90b03261d5a13d78a1b8e51a977d79be19523ffcf45a86fe47cc6345cbe0a7c829c4da8f111a22eb135bdfd50211b3ac7bcbd09

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b2fd622e9b135127847b2e940538d3f1
SHA1 9214a1af7d96e078b0b228e77df20c4beb3c05b7
SHA256 115931a889868ef902212b4a66920e861aaf5ca3789686663212a90d87b2208c
SHA512 5c1a5886296fea6b70812eae9eba32dfd119ed8a60107b6f23e7dd4a872a0893feb0b8a1af7c08d479ab0571f2f93c6d6b9b2668b5b87f98f10c88a041925d22

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5222a277dd0a9650b67f8f15b44ef8ba
SHA1 1622376fc23ea972ce480b29b5f2469334e44b35
SHA256 35d9b9c896d59bd83088f05f25df4f74a357db67013fccd8f30c9bf6efc644b8
SHA512 812c7da9fccccf0622632126beb8022194d3024863103e2baa48effa140221553006892ac17845e11d14d2c1c46fc91c85b092dbeea91e0e34a416164e16370f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 97505e784a0d7a1ce2eb922f3e3e1101
SHA1 8dc382c434aaa12cca7d589dd8561f7a18cdcef5
SHA256 5916c8d6d0c3d426963e9a3fc7941f0ecd1f6279e8a559a3ff34c118a7e6d417
SHA512 4747870e2cebbbb9583d9ab58f7342a0da29e482b86331897813a35f5adf220a95fb3f41299342808470ccb48fec3b33175f4f94beafbeb5201849d87ccee18c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 45ae895f76411f8dc2b65548223f21d1
SHA1 7c0c69ed14557d17d53505d07685f83171de7ba4
SHA256 92c42ea0a54b2c25a104d232f93bde263ed302bb02cb760a59ba5c9898a024e8
SHA512 dbc7c57b0ade24bdd289074f0f5fcdde920d03efa08aa1dc68f859bd37fd1fa7b2bc92117dd7c9dab9be7a2a24d386f3cde2b1dd8ddd26e6b8d95be11c5e3cf9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7ca11ee9e9a00e1b72dec4672c297f3d
SHA1 5916770ae121d5fca2a068be0ee7ce9cc88c005f
SHA256 29afd1f0edeabc017aa6abd1559cf03eadd8c0eb823e31a34b5b97fb640ed0d1
SHA512 fbaf7902703d3006022c9cb572fc04a71ada91f38eeb5db73bf3fb9b5aadcddc874f36f58f308eda31ad98ce3e6453b4f60ef77ddd7b923a10060f600603de70

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3c5b7e9781476e3de3efda0271eb9e5d
SHA1 c88dab4963c29347d213557bdbf6ca10498f1e96
SHA256 2e32925c1fe56e31a97d127646ede2aa275a8b8608c93de040681a3169387025
SHA512 6a82820ea393e193fd0da2cbaddd37743f2ef64929199bf5ad391b474df011af5c28f686a6ee1f809043d844c93bb4dad9aeb1e2d17b2c8baab6104d9f64bf6e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c45997676e89e2231a96b79d52ec0058
SHA1 90813d8d09330df72c508a14a4401a3419f54630
SHA256 2ebfeb94ee597b55099f0ee0579a15527d18ea485e0b2b0ba24d46fba3e50be9
SHA512 ba3e58828bde51ef0169be5290a9d4331be124503944b827451b72c88695e8c8df2b9dbc8c97a95c2f652dce0ec946a745635eb82702d40b67e6222033743f74

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0f02deed7936111db073fdd1adb8ed68
SHA1 fec2c03e4478b25094659effbcd1c2c7bea19d49
SHA256 3dbbb3227f162ad94166afcd99a5a8344334162c3fdf89f4b41f99fa27a3e922
SHA512 05ec8e352ee42b2f79accef111a9a2870097e67720427e16366f79a01da88b2e00504542e77251f01204e94daa6e94ae0951177891d88ea77e44017fe30b815c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8b08acaba2bd966df9d65f08170ff2d5
SHA1 1f439b1f8f2e5f6fcbdf89cac76b18327da0dd21
SHA256 2f2520ca630c735e19c073254b7beff9c0d8cf1fadb5a749f0791032dc9306af
SHA512 714234379d9654a6a6d309dc65cadfbe41f2f6a0b0c1ceb685bcf82b05c93b604203bc862297932455f522c60879bd64a19c34437174d0acaf93c04a794eafb6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c8dd30dd5c29a52e66604368fdf235f1
SHA1 3cd843b94acb0f4e190355150e69439f40f825e8
SHA256 7e1d129a44c8873f0f6084dcbe4dec5dd7e342486898a6343b537a207b84ab9f
SHA512 b532f15af491a952c0cf2048edf65b761f6796b5e8e6362d9f5e56b14bf1f997307704abd2dd3bb4aee5ea6b1bf05dec3e6726aea408241548dc4cf7778e16e9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 120528cddb0ef00faa33178fee992d80
SHA1 dd087e3e3aa6eb478a75c6043b3fe5b5c35c5e41
SHA256 89e5ca9c1c58c337d6a51ef4673b174a356b12f8d19f6ed2432d094fae4d1dd2
SHA512 be2ace76e038b5e700256aced8d55d20b568cce4043a0904019fceffafd86d97527fc14a0c95162c719511e51b791a8ce3011bd60f903d611f69f10905682997

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bf5667fba9150fc6e3547ba95612968b
SHA1 7ec6b799c05da250189ec8a177fa8f01f37e1713
SHA256 b294483e65630f850d19e791f83faf5f5035bc8dd6a1d944f54a8a5a942aef42
SHA512 dccd2fec49e3350cab16e1e461a2ff0d9f70a8afdcc9518c03f8e31dd7cf31ca48f4a7973cc56d9e09b5c40f3732f2f5487492add3c33338051778451344af93