Malware Analysis Report

2025-03-14 23:13

Sample ID 240406-3stqvsee4x
Target e39368bf75d084a3486f575905e422c3_JaffaCakes118
SHA256 95ed5e3915647331d419b0c868229b621d385ce6f22ea2555410c7bdccd37483
Tags
persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

95ed5e3915647331d419b0c868229b621d385ce6f22ea2555410c7bdccd37483

Threat Level: Shows suspicious behavior

The file e39368bf75d084a3486f575905e422c3_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Enumerates connected drives

Modifies WinLogon

Suspicious use of SetThreadContext

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-06 23:47

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-06 23:47

Reported

2024-04-06 23:49

Platform

win7-20240221-en

Max time kernel

146s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\service733.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\service733.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe Reader Speed Launcher = "C:\\Users\\Admin\\AppData\\Roaming\\service733.exe" C:\Users\Admin\AppData\Roaming\service733.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe Reader Speed Launcher = "C:\\Users\\Admin\\AppData\\Roaming\\service733.exe" C:\Users\Admin\AppData\Roaming\service733.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\D: C:\Users\Admin\AppData\Roaming\service733.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Roaming\service733.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Adobe Reader Speed Launcher = "C:\\Users\\Admin\\AppData\\Roaming\\service733.exe" C:\Users\Admin\AppData\Roaming\service733.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\service733.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\service733.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\service733.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2684 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe
PID 2684 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe
PID 2684 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe
PID 2684 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe
PID 2684 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe
PID 2684 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe
PID 2684 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe
PID 2684 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe
PID 2684 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe
PID 2372 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\service733.exe
PID 2372 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\service733.exe
PID 2372 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\service733.exe
PID 2372 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\service733.exe
PID 2624 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Roaming\service733.exe C:\Users\Admin\AppData\Roaming\service733.exe
PID 2624 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Roaming\service733.exe C:\Users\Admin\AppData\Roaming\service733.exe
PID 2624 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Roaming\service733.exe C:\Users\Admin\AppData\Roaming\service733.exe
PID 2624 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Roaming\service733.exe C:\Users\Admin\AppData\Roaming\service733.exe
PID 2624 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Roaming\service733.exe C:\Users\Admin\AppData\Roaming\service733.exe
PID 2624 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Roaming\service733.exe C:\Users\Admin\AppData\Roaming\service733.exe
PID 2624 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Roaming\service733.exe C:\Users\Admin\AppData\Roaming\service733.exe
PID 2624 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Roaming\service733.exe C:\Users\Admin\AppData\Roaming\service733.exe
PID 2624 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Roaming\service733.exe C:\Users\Admin\AppData\Roaming\service733.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\service733.exe

-n

C:\Users\Admin\AppData\Roaming\service733.exe

-n

Network

Country Destination Domain Proto
US 8.8.8.8:53 ns3.kasprsky.org udp
US 8.8.8.8:53 ns3.dwonkistrz.org udp
US 8.8.8.8:53 ns3.lksadxniuszkla.org udp
US 104.155.138.21:5739 ns3.lksadxniuszkla.org tcp

Files

memory/2372-0-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2372-2-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2372-4-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2372-6-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2372-7-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2372-9-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2372-11-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2372-12-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2372-13-0x0000000000400000-0x000000000041A000-memory.dmp

\Users\Admin\AppData\Roaming\service733.exe

MD5 e39368bf75d084a3486f575905e422c3
SHA1 5e906edbf24709f1b0b3e7500a2134ef35739b8e
SHA256 95ed5e3915647331d419b0c868229b621d385ce6f22ea2555410c7bdccd37483
SHA512 121792accd02db8dc3b8fad1d84f7b5c5a54319293a831b73dd3ae56677a1405e823046e54c68a9d29db8c871c71508ad04caa00db836772a74c1bcc74202dc5

memory/2372-22-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2992-40-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2992-41-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2992-42-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2992-43-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2992-45-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2992-47-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2992-50-0x0000000000400000-0x000000000041A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-06 23:47

Reported

2024-04-06 23:49

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

152s

Command Line

C:\Windows\sysmon.exe

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\service481.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\service481.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe Reader Speed Launcher = "C:\\Users\\Admin\\AppData\\Roaming\\service481.exe" C:\Users\Admin\AppData\Roaming\service481.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe Reader Speed Launcher = "C:\\Users\\Admin\\AppData\\Roaming\\service481.exe" C:\Users\Admin\AppData\Roaming\service481.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\D: C:\Users\Admin\AppData\Roaming\service481.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Roaming\service481.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Adobe Reader Speed Launcher = "C:\\Users\\Admin\\AppData\\Roaming\\service481.exe" C:\Users\Admin\AppData\Roaming\service481.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\service481.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\service481.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\service481.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\service481.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\service481.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\service481.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\service481.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\service481.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\service481.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\service481.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\service481.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\service481.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\service481.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 392 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe
PID 392 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe
PID 392 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe
PID 392 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe
PID 392 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe
PID 392 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe
PID 392 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe
PID 392 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe
PID 4064 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\service481.exe
PID 4064 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\service481.exe
PID 4064 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\service481.exe
PID 3580 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Users\Admin\AppData\Roaming\service481.exe
PID 3580 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Users\Admin\AppData\Roaming\service481.exe
PID 3580 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Users\Admin\AppData\Roaming\service481.exe
PID 3580 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Users\Admin\AppData\Roaming\service481.exe
PID 3580 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Users\Admin\AppData\Roaming\service481.exe
PID 3580 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Users\Admin\AppData\Roaming\service481.exe
PID 3580 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Users\Admin\AppData\Roaming\service481.exe
PID 3580 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Users\Admin\AppData\Roaming\service481.exe
PID 4364 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Windows\sysmon.exe
PID 4364 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Windows\sysmon.exe
PID 4364 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
PID 4364 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
PID 4364 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4364 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4364 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4364 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4364 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4364 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4364 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4364 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4364 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4364 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4364 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4364 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4364 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4364 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Roaming\service481.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Windows\sysmon.exe

C:\Windows\sysmon.exe

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffbbac52e98,0x7ffbbac52ea4,0x7ffbbac52eb0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2300 --field-trial-handle=2304,i,7548677271533893574,11048237606705436109,262144 --variations-seed-version /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3320 --field-trial-handle=2304,i,7548677271533893574,11048237606705436109,262144 --variations-seed-version /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3536 --field-trial-handle=2304,i,7548677271533893574,11048237606705436109,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5300 --field-trial-handle=2304,i,7548677271533893574,11048237606705436109,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5556 --field-trial-handle=2304,i,7548677271533893574,11048237606705436109,262144 --variations-seed-version /prefetch:1

C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e39368bf75d084a3486f575905e422c3_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\service481.exe

-n

C:\Users\Admin\AppData\Roaming\service481.exe

-n

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2304,i,7548677271533893574,11048237606705436109,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 ns3.kasprsky.org udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 ns3.dwonkistrz.org udp
US 8.8.8.8:53 ns3.lksadxniuszkla.org udp
US 104.155.138.21:5739 ns3.lksadxniuszkla.org tcp
US 8.8.8.8:53 21.138.155.104.in-addr.arpa udp

Files

memory/4064-0-0x0000000000400000-0x000000000041A000-memory.dmp

memory/4064-2-0x0000000000400000-0x000000000041A000-memory.dmp

memory/4064-4-0x0000000000400000-0x000000000041A000-memory.dmp

memory/4064-3-0x0000000000400000-0x000000000041A000-memory.dmp

C:\Users\Admin\AppData\Roaming\service481.exe

MD5 e39368bf75d084a3486f575905e422c3
SHA1 5e906edbf24709f1b0b3e7500a2134ef35739b8e
SHA256 95ed5e3915647331d419b0c868229b621d385ce6f22ea2555410c7bdccd37483
SHA512 121792accd02db8dc3b8fad1d84f7b5c5a54319293a831b73dd3ae56677a1405e823046e54c68a9d29db8c871c71508ad04caa00db836772a74c1bcc74202dc5

memory/4064-9-0x0000000000400000-0x000000000041A000-memory.dmp

memory/4364-17-0x0000000000400000-0x000000000041A000-memory.dmp

memory/4364-18-0x0000000000400000-0x000000000041A000-memory.dmp

memory/4364-20-0x0000000000400000-0x000000000041A000-memory.dmp

memory/4364-19-0x0000000000400000-0x000000000041A000-memory.dmp

memory/4364-22-0x0000000000400000-0x000000000041A000-memory.dmp

memory/4364-24-0x0000000000400000-0x000000000041A000-memory.dmp

memory/4364-27-0x0000000000400000-0x000000000041A000-memory.dmp