Malware Analysis Report

2024-09-11 02:46

Sample ID 240529-fxpalsbe8x
Target 7f984bd57165eb00743f13a71ac54482_JaffaCakes118
SHA256 a8003bdf69d3bb1d41d1ddeaee63fd1b9965a8164a0abbf46d49bd0ffcb5922a
Tags
neshta persistence spyware stealer discovery
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a8003bdf69d3bb1d41d1ddeaee63fd1b9965a8164a0abbf46d49bd0ffcb5922a

Threat Level: Known bad

The file 7f984bd57165eb00743f13a71ac54482_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

neshta persistence spyware stealer discovery

Neshta

Neshta family

Detect Neshta payload

Sets file execution options in registry

Checks computer location settings

Registers COM server for autorun

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Modifies file permissions

Modifies system executable filetype association

Checks system information in the registry

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies system certificate store

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Event Triggered Execution
T1546
Change Default File Association
T1546.001
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Event Triggered Execution
T1546
Change Default File Association
T1546.001
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
File and Directory Permissions Modification
T1222
Subvert Trust Controls
T1553
Install Root Certificate
T1553.004
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-29 05:15

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A

Neshta family

neshta

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-29 05:15

Reported

2024-05-29 05:17

Platform

win7-20240419-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Neshta

persistence spyware neshta

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Java\jre7\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre7\bin\javaw.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2172 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe
PID 2172 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe
PID 2172 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe
PID 2172 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe
PID 2188 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe C:\Program Files\Java\jre7\bin\javaw.exe
PID 2188 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe C:\Program Files\Java\jre7\bin\javaw.exe
PID 2188 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe C:\Program Files\Java\jre7\bin\javaw.exe
PID 2188 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe C:\Program Files\Java\jre7\bin\javaw.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe"

C:\Program Files\Java\jre7\bin\javaw.exe

"C:\Program Files\Java\jre7\bin\javaw.exe" -Dvw-l4j="true" -jar "C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 cdn.vimeworld.ru udp
US 172.67.207.241:443 cdn.vimeworld.ru tcp
US 8.8.8.8:53 cdn.vimeworld.com udp
US 172.67.216.120:443 cdn.vimeworld.com tcp

Files

\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe

MD5 ae01f96af91a216d7ec695fadbe17761
SHA1 00b2c7cae57defeebc8dd440dfe586007afce7b7
SHA256 2cb52060f3e856f6c561b16fef538e5a8e2b3baf7098b9884b31c9dddf335bc0
SHA512 17b54971c3d8b15807944ec0a5e9bfd72fa1f9c95890b0701685628b0de63434d8fad1a88e5cd52a493fa49eaf204cbf4442b4c10a0c866118b93e797f5c65c8

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

MD5 cf6c595d3e5e9667667af096762fd9c4
SHA1 9bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256 593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512 ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

memory/2188-12-0x0000000000400000-0x000000000046D000-memory.dmp

memory/2224-18-0x0000000002620000-0x0000000002890000-memory.dmp

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

memory/2224-92-0x0000000000130000-0x0000000000131000-memory.dmp

memory/2224-111-0x00000000002C0000-0x00000000002CA000-memory.dmp

memory/2224-110-0x00000000002C0000-0x00000000002CA000-memory.dmp

memory/2224-114-0x0000000000130000-0x0000000000131000-memory.dmp

memory/2172-116-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2172-118-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2224-119-0x0000000002620000-0x0000000002890000-memory.dmp

memory/2224-121-0x00000000002C0000-0x00000000002CA000-memory.dmp

memory/2224-120-0x00000000002C0000-0x00000000002CA000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-29 05:15

Reported

2024-05-29 05:17

Platform

win10v2004-20240508-en

Max time kernel

139s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Neshta

persistence spyware neshta

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\PROGRA~2\MICROS~1\EDGEUP~2\MICROS~1.EXE N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Registers COM server for autorun

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_kn.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_vi.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_ug.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~2\MICROS~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_lv.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MIA062~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_id.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_am.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_fa.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_bs.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_pa.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_as.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~2\13187~1.39\MI391D~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~2\13187~1.39\MIA062~1.EXE C:\Windows\svchost.com N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_en-GB.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_uk.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_quz.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~3.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_da.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_fi.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_fr-CA.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_km.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_nn.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_tt.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_el.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_gu.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~2\13187~1.39\MICROS~1.EXE C:\Windows\svchost.com N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_es-419.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_pt-BR.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_kk.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_iw.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\psmachine_64.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_sr.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_ka.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_sq.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~2\13187~1.39\MICROS~2.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~4.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13187~1.37\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_ja.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Windows\svchost.com N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\VersionIndependentProgID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ = "Microsoft Edge Update Broker Class Factory" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32\ = "{2B1EC306-3EDE-4012-9BB0-FB836132FF52}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\VERSIONINDEPENDENTPROGID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32\ = "{2B1EC306-3EDE-4012-9BB0-FB836132FF52}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\ = "Microsoft Edge Update Update3Web" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\AppID = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods\ = "27" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{2B1EC306-3EDE-4012-9BB0-FB836132FF52}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\ = "Microsoft Edge Update Core Class" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32\ = "{2B1EC306-3EDE-4012-9BB0-FB836132FF52}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\PROGID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89FDB4D0-1F76-49D6-A941-6C3C08FC261F}\InprocHandler32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\msedgeupdate.dll,-3000" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods\ = "23" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods\ = "41" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods\ = "23" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32\ = "{2B1EC306-3EDE-4012-9BB0-FB836132FF52}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\Elevation\Enabled = "1" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VersionIndependentProgID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ = "IGoogleUpdate3WebSecurity" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods\ = "5" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{2B1EC306-3EDE-4012-9BB0-FB836132FF52}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ELEVATION C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods\ = "8" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\msedgeupdate.dll,-3000" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Java\jre-1.8\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre-1.8\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre-1.8\bin\javaw.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 928 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe
PID 928 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe
PID 928 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe
PID 4660 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe C:\Program Files\Java\jre-1.8\bin\javaw.exe
PID 4660 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe C:\Program Files\Java\jre-1.8\bin\javaw.exe
PID 1064 wrote to memory of 4316 N/A C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Windows\system32\icacls.exe
PID 1064 wrote to memory of 4316 N/A C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Windows\system32\icacls.exe
PID 1064 wrote to memory of 4840 N/A C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 1064 wrote to memory of 4840 N/A C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 4840 wrote to memory of 1996 N/A C:\Windows\SYSTEM32\cmd.exe C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe
PID 4840 wrote to memory of 1996 N/A C:\Windows\SYSTEM32\cmd.exe C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe
PID 1996 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
PID 1996 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
PID 1996 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
PID 1304 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe
PID 1304 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe
PID 1304 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe
PID 2336 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 2336 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 2336 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 2336 wrote to memory of 5004 N/A C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 2336 wrote to memory of 5004 N/A C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 2336 wrote to memory of 5004 N/A C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 5004 wrote to memory of 2144 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 5004 wrote to memory of 2144 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 5004 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 5004 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 5004 wrote to memory of 1012 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 5004 wrote to memory of 1012 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 2336 wrote to memory of 4904 N/A C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 2336 wrote to memory of 4904 N/A C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 2336 wrote to memory of 4904 N/A C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 2336 wrote to memory of 3752 N/A C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe C:\Windows\svchost.com
PID 2336 wrote to memory of 3752 N/A C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe C:\Windows\svchost.com
PID 2336 wrote to memory of 3752 N/A C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe C:\Windows\svchost.com
PID 3752 wrote to memory of 1488 N/A C:\Windows\svchost.com C:\PROGRA~2\MICROS~1\EDGEUP~2\MICROS~1.EXE
PID 3752 wrote to memory of 1488 N/A C:\Windows\svchost.com C:\PROGRA~2\MICROS~1\EDGEUP~2\MICROS~1.EXE
PID 3752 wrote to memory of 1488 N/A C:\Windows\svchost.com C:\PROGRA~2\MICROS~1\EDGEUP~2\MICROS~1.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe"

C:\Program Files\Java\jre-1.8\bin\javaw.exe

"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dvw-l4j="true" -jar "C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe"

C:\Windows\system32\icacls.exe

C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

C:\Windows\SYSTEM32\cmd.exe

cmd /d /c start "" "C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkJFMjNFMDgtMUQyMi00NTU2LThCOEMtQzZFRDk2MURGMkM5fSIgdXNlcmlkPSJ7NzJBN0NEQzQtQ0ZGQi00NzhCLUI2QTQtNTU0QjNEQTRFNTNCfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezkzM0M2NUI0LTMyOTctNDU4Ny05MjlELUQ2OEE0MzVDRDk5QX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtEeE9iakhHYStuUmEyYXRDM3dvK0lFcEM3OCtaWWVBVWJrWHBEQzJjajdVPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTg3LjM3IiBuZXh0dmVyc2lvbj0iMS4zLjE4Ny4zOSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDYzMjczNjE3NyIgaW5zdGFsbF90aW1lX21zPSI4NDMiLz48L2FwcD48L3JlcXVlc3Q-

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\PROGRA~2\MICROS~1\EDGEUP~2\MICROS~1.EXE" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource taggedmi /sessionid "{6BE23E08-1D22-4556-8B8C-C6ED961DF2C9}"

C:\PROGRA~2\MICROS~1\EDGEUP~2\MICROS~1.EXE

C:\PROGRA~2\MICROS~1\EDGEUP~2\MICROS~1.EXE /handoff appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers /installsource taggedmi /sessionid {6BE23E08-1D22-4556-8B8C-C6ED961DF2C9}

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 cdn.vimeworld.ru udp
US 172.67.207.241:443 cdn.vimeworld.ru tcp
US 8.8.8.8:53 cdn.vimeworld.com udp
US 172.67.216.120:443 cdn.vimeworld.com tcp
US 8.8.8.8:53 241.207.67.172.in-addr.arpa udp
US 8.8.8.8:53 120.216.67.172.in-addr.arpa udp
US 8.8.8.8:53 files-cdn.vimeworld.net udp
US 172.67.178.166:443 files-cdn.vimeworld.net tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 166.178.67.172.in-addr.arpa udp
US 172.67.178.166:443 files-cdn.vimeworld.net tcp
US 172.67.216.120:443 cdn.vimeworld.com tcp
US 8.8.8.8:53 apps.identrust.com udp
NL 23.63.101.170:80 apps.identrust.com tcp
US 8.8.8.8:53 170.101.63.23.in-addr.arpa udp
US 8.8.8.8:53 msedge.sf.dl.delivery.mp.microsoft.com udp
US 152.199.21.175:443 msedge.sf.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 175.21.199.152.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe

MD5 ae01f96af91a216d7ec695fadbe17761
SHA1 00b2c7cae57defeebc8dd440dfe586007afce7b7
SHA256 2cb52060f3e856f6c561b16fef538e5a8e2b3baf7098b9884b31c9dddf335bc0
SHA512 17b54971c3d8b15807944ec0a5e9bfd72fa1f9c95890b0701685628b0de63434d8fad1a88e5cd52a493fa49eaf204cbf4442b4c10a0c866118b93e797f5c65c8

memory/4660-12-0x0000000000400000-0x000000000046D000-memory.dmp

memory/1064-15-0x000001E5A75C0000-0x000001E5A7830000-memory.dmp

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

MD5 cfcf6d843ab1eb9e3eb1f95fce44419a
SHA1 3e6e28a76f4d37eef6ee827d7eb576651622920b
SHA256 a29880f8cf903a20f1864194ace847d766cb879c4f0a4fdf0f17eb309b50c7b6
SHA512 c69e36027e32f9d723ad6a738c22ecb90e7f5897543504d359375466518b88599b71e7c0fe6d0b10b3b985fa0ce20975833c6c41f376e1d768ae1ca66079d6d1

memory/1064-32-0x000001E5A7830000-0x000001E5A7840000-memory.dmp

memory/1064-34-0x000001E5A7840000-0x000001E5A7850000-memory.dmp

memory/1064-38-0x000001E5A7850000-0x000001E5A7860000-memory.dmp

memory/1064-39-0x000001E5A7860000-0x000001E5A7870000-memory.dmp

memory/1064-37-0x000001E5A5DC0000-0x000001E5A5DC1000-memory.dmp

memory/1064-46-0x000001E5A7890000-0x000001E5A78A0000-memory.dmp

memory/1064-45-0x000001E5A7880000-0x000001E5A7890000-memory.dmp

memory/1064-44-0x000001E5A7870000-0x000001E5A7880000-memory.dmp

memory/1064-48-0x000001E5A78A0000-0x000001E5A78B0000-memory.dmp

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

MD5 3b73078a714bf61d1c19ebc3afc0e454
SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

memory/1064-61-0x000001E5A78D0000-0x000001E5A78E0000-memory.dmp

memory/1064-64-0x000001E5A78E0000-0x000001E5A78F0000-memory.dmp

memory/1064-62-0x000001E5A78F0000-0x000001E5A7900000-memory.dmp

memory/1064-57-0x000001E5A78B0000-0x000001E5A78C0000-memory.dmp

memory/1064-60-0x000001E5A78C0000-0x000001E5A78D0000-memory.dmp

memory/1064-76-0x000001E5A75C0000-0x000001E5A7830000-memory.dmp

memory/1064-77-0x000001E5A7900000-0x000001E5A7910000-memory.dmp

memory/1064-83-0x000001E5A7920000-0x000001E5A7930000-memory.dmp

memory/1064-84-0x000001E5A7930000-0x000001E5A7940000-memory.dmp

memory/1064-82-0x000001E5A7910000-0x000001E5A7920000-memory.dmp

memory/1064-86-0x000001E5A7940000-0x000001E5A7950000-memory.dmp

memory/1064-85-0x000001E5A7830000-0x000001E5A7840000-memory.dmp

memory/1064-89-0x000001E5A7950000-0x000001E5A7960000-memory.dmp

memory/1064-88-0x000001E5A7840000-0x000001E5A7850000-memory.dmp

memory/1064-93-0x000001E5A7960000-0x000001E5A7970000-memory.dmp

memory/1064-92-0x000001E5A7850000-0x000001E5A7860000-memory.dmp

memory/1064-94-0x000001E5A7860000-0x000001E5A7870000-memory.dmp

memory/1064-95-0x000001E5A7970000-0x000001E5A7980000-memory.dmp

memory/1064-105-0x000001E5A7990000-0x000001E5A79A0000-memory.dmp

memory/1064-104-0x000001E5A78C0000-0x000001E5A78D0000-memory.dmp

memory/1064-103-0x000001E5A78A0000-0x000001E5A78B0000-memory.dmp

memory/1064-102-0x000001E5A7980000-0x000001E5A7990000-memory.dmp

memory/1064-101-0x000001E5A7890000-0x000001E5A78A0000-memory.dmp

memory/1064-100-0x000001E5A7880000-0x000001E5A7890000-memory.dmp

memory/1064-99-0x000001E5A7870000-0x000001E5A7880000-memory.dmp

memory/1064-107-0x000001E5A78B0000-0x000001E5A78C0000-memory.dmp

memory/1064-110-0x000001E5A79A0000-0x000001E5A79B0000-memory.dmp

memory/1064-109-0x000001E5A78F0000-0x000001E5A7900000-memory.dmp

memory/1064-108-0x000001E5A78D0000-0x000001E5A78E0000-memory.dmp

memory/1064-114-0x000001E5A79B0000-0x000001E5A79C0000-memory.dmp

memory/1064-113-0x000001E5A78E0000-0x000001E5A78F0000-memory.dmp

memory/1064-117-0x000001E5A5DC0000-0x000001E5A5DC1000-memory.dmp

memory/1064-120-0x000001E5A79C0000-0x000001E5A79D0000-memory.dmp

memory/1064-119-0x000001E5A7900000-0x000001E5A7910000-memory.dmp

memory/1064-131-0x000001E5A7930000-0x000001E5A7940000-memory.dmp

memory/1064-132-0x000001E5A79D0000-0x000001E5A79E0000-memory.dmp

memory/1064-129-0x000001E5A7920000-0x000001E5A7930000-memory.dmp

memory/1064-128-0x000001E5A7910000-0x000001E5A7920000-memory.dmp

memory/1064-153-0x000001E5A5DC0000-0x000001E5A5DC1000-memory.dmp

memory/1064-163-0x000001E5A79E0000-0x000001E5A79F0000-memory.dmp

memory/1064-162-0x000001E5A7940000-0x000001E5A7950000-memory.dmp

memory/1064-181-0x000001E5A7950000-0x000001E5A7960000-memory.dmp

memory/1064-182-0x000001E5A79F0000-0x000001E5A7A00000-memory.dmp

memory/1064-188-0x000001E5A7A00000-0x000001E5A7A10000-memory.dmp

memory/1064-187-0x000001E5A7960000-0x000001E5A7970000-memory.dmp

memory/1064-191-0x000001E5A5DC0000-0x000001E5A5DC1000-memory.dmp

memory/1064-195-0x000001E5A7980000-0x000001E5A7990000-memory.dmp

memory/1064-196-0x000001E5A7A10000-0x000001E5A7A20000-memory.dmp

memory/1064-194-0x000001E5A7970000-0x000001E5A7980000-memory.dmp

memory/1064-211-0x000001E5A7A20000-0x000001E5A7A30000-memory.dmp

memory/1064-216-0x000001E5A7A30000-0x000001E5A7A40000-memory.dmp

memory/1064-215-0x000001E5A7990000-0x000001E5A79A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe

MD5 6f1270cba80929286ed1f5dfa1502c3e
SHA1 449ecb2a1e401f3b27fbd9873254663deb37f480
SHA256 f5011e0359c5b26dffee5b392f1b3f1ec056f822ae423465ea3cda373d3f9537
SHA512 76bad7412e2dd3234db5685beede27bbb634cbd8d9cab855cdd429be1a016e9c726d5bc0a37f8ed22eea24073b150aa01732da07faa917d7427f86fc5d705d2b

memory/1064-227-0x000001E5A79B0000-0x000001E5A79C0000-memory.dmp

memory/1064-225-0x000001E5A7A40000-0x000001E5A7A50000-memory.dmp

memory/1064-224-0x000001E5A79A0000-0x000001E5A79B0000-memory.dmp

memory/1064-228-0x000001E5A7A50000-0x000001E5A7A60000-memory.dmp

memory/1064-231-0x000001E5A7A60000-0x000001E5A7A70000-memory.dmp

memory/1064-230-0x000001E5A79C0000-0x000001E5A79D0000-memory.dmp

memory/1064-235-0x000001E5A7A70000-0x000001E5A7A80000-memory.dmp

memory/1064-234-0x000001E5A79D0000-0x000001E5A79E0000-memory.dmp

memory/1064-237-0x000001E5A5DC0000-0x000001E5A5DC1000-memory.dmp

memory/1064-238-0x000001E5A79E0000-0x000001E5A79F0000-memory.dmp

memory/1064-239-0x000001E5A7A80000-0x000001E5A7A90000-memory.dmp

memory/1064-252-0x000001E5A79F0000-0x000001E5A7A00000-memory.dmp

memory/1064-253-0x000001E5A7A90000-0x000001E5A7AA0000-memory.dmp

memory/1064-256-0x000001E5A7AA0000-0x000001E5A7AB0000-memory.dmp

memory/1064-255-0x000001E5A7A00000-0x000001E5A7A10000-memory.dmp

memory/1064-258-0x000001E5A7A10000-0x000001E5A7A20000-memory.dmp

memory/1064-259-0x000001E5A7AB0000-0x000001E5A7AC0000-memory.dmp

memory/1064-266-0x000001E5A7AD0000-0x000001E5A7AE0000-memory.dmp

memory/1064-264-0x000001E5A7A20000-0x000001E5A7A30000-memory.dmp

memory/1064-265-0x000001E5A7AC0000-0x000001E5A7AD0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\7f984bd57165eb00743f13a71ac54482_JaffaCakes118.exe

MD5 3a8cf70506e363d6121d0f6d68689b44
SHA1 a6f888d8df15544875dad58e71a00595a8cd6000
SHA256 e3f352fa69814be9469f63428a7f69168b70ea47eb8a15f649714c27f1631e04
SHA512 9815c9c936b5d64e44542be04e66297631cabf71c081572aa27efcfa00fb87b8a1107d2d1829d83c7a8b6e7a9a423c9a5adf1b9a6aca484ded87eba5668805fd

memory/1064-281-0x000001E5A5DC0000-0x000001E5A5DC1000-memory.dmp

memory/1064-285-0x000001E5A7850000-0x000001E5A7860000-memory.dmp

memory/1064-282-0x000001E5A7860000-0x000001E5A7870000-memory.dmp

memory/1064-283-0x000001E5A7830000-0x000001E5A7840000-memory.dmp

memory/1064-287-0x000001E5A7870000-0x000001E5A7880000-memory.dmp

memory/1064-300-0x000001E5A7940000-0x000001E5A7950000-memory.dmp

memory/1064-299-0x000001E5A7930000-0x000001E5A7940000-memory.dmp

memory/1064-298-0x000001E5A7920000-0x000001E5A7930000-memory.dmp

memory/1064-297-0x000001E5A7910000-0x000001E5A7920000-memory.dmp

memory/1064-296-0x000001E5A7900000-0x000001E5A7910000-memory.dmp

memory/1064-295-0x000001E5A78C0000-0x000001E5A78D0000-memory.dmp

memory/1064-294-0x000001E5A78F0000-0x000001E5A7900000-memory.dmp

memory/1064-293-0x000001E5A78D0000-0x000001E5A78E0000-memory.dmp

memory/1064-292-0x000001E5A78E0000-0x000001E5A78F0000-memory.dmp

memory/1064-291-0x000001E5A78B0000-0x000001E5A78C0000-memory.dmp

memory/1064-290-0x000001E5A78A0000-0x000001E5A78B0000-memory.dmp

memory/1064-289-0x000001E5A7890000-0x000001E5A78A0000-memory.dmp

memory/1064-288-0x000001E5A7880000-0x000001E5A7890000-memory.dmp

memory/1064-286-0x000001E5A75C0000-0x000001E5A7830000-memory.dmp

memory/1064-284-0x000001E5A7840000-0x000001E5A7850000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

MD5 c06e9135c420469715d4310bfb3c1b33
SHA1 08b7b18662f19a5193ef92cdcdba63eefb7d80a7
SHA256 34efce66f80ccdf56ec4697d323922ca751c783099b9e0d1a38eec054776182f
SHA512 56260285eb6c19698daf7cc7b74e8b4d4b11a5f892c7d22c62ccb51353947d81192790957916a52dc4eb579f27cb38ed67c5b4fabd449850c8949581f07e847e

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdate.exe

MD5 d80d6c8774203980beb027e2192f7df0
SHA1 cadf926c78a87b65289979388c34191925b57167
SHA256 41587c47ed8b365599332d5e321437a6dfca746edfc782a231f5d0d4174b5cb8
SHA512 c7f67d6c11ab42619b10f341bff9e433fbd36c40fadd283485d60cadbffee8f7448144b221416445aab92593a08c42a6639a225f0baa064cb9cf090d9169cbde

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdate.dll

MD5 bfc0ece0ce72654a772f425a2f6a7f89
SHA1 a464076f5d87582dce2adeeaf3b522c688d5a14a
SHA256 bd57792535d7f2c75136fe09241fce48b225b7d451b5e6241cd40e6374db388e
SHA512 b027339fe0d73fccbad23ecb34dc8e40f6e0c64584ee0367a2c565802fcd6870fd28563f19789207d2e6a4e13d1ffff515fc10a22193a7765115be927106255c

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_en.dll

MD5 7f82701452b6dfdf75c83df9b865a168
SHA1 cbc560711f74a63781c5de971421a7c3d87452de
SHA256 fb69f9c72a5026b21ebe7717e58f7382ac8a960849c4676b5733948aedf186a0
SHA512 be6ef129d66a0413edb0c67b82bd4fa3d58e63f61ba5969781c19fee11b37fc6665dad3f99331e5b813e40f9b5a0ecf80412712885b8cd920ded6b7d43d2c82b

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_bg.dll

MD5 e53485ec77800ab9ea0283aac2d0aa89
SHA1 7b4bd4a142a78a95273a91396fbed85432789f34
SHA256 6b380706e9273948be9995da09e3aebb71e7275ba6852086cf5bd1594c7d1232
SHA512 514617c4142cb5f1eb2f72be50d81158136d427d83a8d4f93e6c0c08c30fa012379453a2046ab068cb51853e8c8b12b81df4c18ee80cfb279d80ce4ba5d65b04

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_da.dll

MD5 887777535ec4dafc37e04009dc33d46e
SHA1 87755165910c80b6451e6e49c6a5dea346f949f2
SHA256 8123fc78e3217a67de7051574abc16d33043ac9a1d67fbe1220a51ef92c8d80e
SHA512 a67f21474ffdad53ffbdaa8cf8142b399eba399daedaa7c82b62b4d4629b1d60bcb6f04e87ca030299c14dac9f6c291c5d4069181bdc14c83def63c0ac0c68e3

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_en-GB.dll

MD5 f80b43c11b35344c4601f91d61ba01aa
SHA1 9cdbe9b73dc803e642cdf8fa7c9be3ed13928009
SHA256 18cc6c1c2cb593f1f0450745e5ad4d5d0be3b7d6d3f904b907ffb863391badba
SHA512 be390c82be4956090d55f96ef78387d3fe4abb149ddeb66fa6e61c52d2c480f0cd7cce580554ad2743c118697a2d761e1f0ff37f7f50ac437e6f154143fc1ff9

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_es-419.dll

MD5 3c2f0bf38763071676a0e2d3428d3ce2
SHA1 d7f550ad1b00df2ef3dc962ace455958e0c715c3
SHA256 0ae0b861bc4079593e4fe9a2721b187245a80afec33742f80fa7bab4c63928bc
SHA512 9317ae64848b626b95c7f129c4ca30ec64e6ae6f686b4a71a9a31d2cbc1adde352001463421a5581324a85d4492b9d06f58698fb89c4c80775fdb1ee91eaf87f

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_fil.dll

MD5 49c11b98ab805533476c335f62502a73
SHA1 74bf2b11f0a695f5581ede4f2e4215decd5e0409
SHA256 6b982a78ff95831477342ed6935dbd3abd1f730dd9bf364afc2556ce6a3afd50
SHA512 3e64b2f1b15bf4436368732757f2a92f8983da5a996dd179824e82205041c41b2235a00c3bd0d765d5630d20902dc978018436657114f569aa89e09b3bde69c4

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_lb.dll

MD5 ff47bde993d34dd79c66acb70db09009
SHA1 6a8817b7cab9d2335059c0130f1b95e35431591e
SHA256 db43e3263a24600cea81ae634c8f42a41d22a52479c873b28bc260b0400e7220
SHA512 3ec1bf2363534f399093780503a4c77b4d878d208ef55613c2e41687eb6dac26c75e541b4f93115de5a06432cb3aef3715d3f282cd06a7d41983db3a1ad28a4c

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_lt.dll

MD5 ad30a4fe50163bfdb3796ed7bd5fa376
SHA1 3d307f23e8be36575806a12de3eff54fce9240e3
SHA256 cef18c955461bf41a2f0dffbdd4680f5a4d760fd587aa595caadbf6e5ecc173a
SHA512 8f318e17fcc89d3a637253bb253851fc65bee1baa2fe4ecb8b93966f05f5a207ad1fd8f9a5899a0b276d0efb61cfc5c3dcaad917d4012d343ffc31a8c315788a

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_lo.dll

MD5 cc680df66d6678d2eb8cfbdee2e44a61
SHA1 29c5286be2304147f1b9e9ebb0ed1cf7e41ff791
SHA256 30ba2826611d043a59314f335e6af343d6bcb738ca6ebf0307268a20cbc03d46
SHA512 fca9dcd7deaf2d5870f70df0be8fec8d8df395b71b931819f848c9bbd922a85b8d55eaba4c00106c364f5fc85fd10254659df29be8d87b0296eeb830719effe8

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_kok.dll

MD5 cad04507b6038d757a28aee789d16fda
SHA1 0bffa7678d129a235becac22662fa807b7b6319e
SHA256 72c3acca20e4fc82d12635756977a353f5698249ae87e401012d243cb348746c
SHA512 4567b19fb854f3866b627ed13aa6c122b5ee9d0d06379b09f38f3a15f15e81e26ac7f3ef572fb4340313e47c1285ebddf8438c6b19da527f72c3b051d5f954d2

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_ko.dll

MD5 b2d7a95280580a921ece1f65593e79d0
SHA1 b611e29593788ab46b3d86f472d08e90a2a3ca88
SHA256 2f4221684404a9a0dca802102ef5e1bc263d5ea4435265384cc85d55188dfd3e
SHA512 bb6cdbf4f8ea20bf39bd24801d0a8710c714b9d7070776178810325213f8c797978437f9e647510a8ff613ae8245871bdf7daff7e48372eb395604022442aa1d

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_km.dll

MD5 e133ef71c5724664908ef2cd7af775b4
SHA1 a30990a3384c62b04259c10d7019ee41fe517c7c
SHA256 0425f6ec9cfc4f79a43a2963903922526fcd877225da01f88009c7380a0678b8
SHA512 86e7188d9faad6635439c9518b5d038b5f60bec3de16b18ae9c1a6574bbeb76b8ba677bfd77b24329a4b6df00c4571a7a932d9afd025d43747007b73fbb419bf

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_kk.dll

MD5 1349c9ae143856ff8af98d8969f97964
SHA1 b0774042bee34fa2d1fe2bb65ca21a71b6a5e630
SHA256 d8ed80b5de016554f15b67c68dbcf495807697f56c3bd2ddd3c587719b870c9b
SHA512 912e36fd2e23d4508a89392e713ebe6e8fdbd99576afa1a12a743cfeb3e1cefbbe024d973550015f9dea8bda9309d353871f3ed32d7a51b1e44ac46449b72180

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_ka.dll

MD5 ac87df6bb94463336a09c2cbdd17b23d
SHA1 71b45a3e00d593aa0569a4316d9f48dd7ae6540d
SHA256 f97d24c55a1563767cb606ab7644ce10c871989a8fe86786e27d17dbede4de7f
SHA512 391d352fe0d997db1462e00e19da52c48ae79225afcfb083ff1e10a9f005090b1de0b3e1f5129c8a2cde1d2264dd4a91398d8d1c121c24e7d847eb824028a38f

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_ja.dll

MD5 0a4f6041656b7441e2aa9184163f4b44
SHA1 3f4f700e5b9b82a661681d37a4c321fcf98e1bf7
SHA256 53e4719733ae1819d642815bc27e576dae5cfba1e592714e2c9976bc2f1246b6
SHA512 f63d1873f4b364d7eadb26bf0a2fca2146e7c4e4ec17350f1adfba82b76cf127c5f1983bcd12895713ec3299624b6f0fe9c09ac4b58add475e4b633938ade235

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_iw.dll

MD5 87c3c118e280e39eabb8d545617592e7
SHA1 b952980c0436df129e10571fbc79ae6dd78aa5a1
SHA256 f14b2b780c72815e2e398816867b6dee5afcec9eb5e72efe733b6926f08c9d14
SHA512 37469d8fc4cb037f057ea96fe49edbb02515df2584018b04dd7665c6544c1fc140430cf5be70fa99e6392227f92e7383291570c32f79b271f0f771a8dfe93b53

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_it.dll

MD5 b73574b5bdfa3126045dcf4b489df505
SHA1 7cd73a13d1f0af197637b14977427f9df761e29f
SHA256 2fb9bcb4826b747701d41ed53f1dc7d4c0e2f0b2c8d0b1b7a6dbf43fa5349197
SHA512 13e6dc225cfcb2292d72a161270d6ecb0a0c1b6b48ee1708e49ac64000e512f7f6a3984bfb680add36a34d44bdd7ba619da873eca4aa63f53215074f420f576e

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_is.dll

MD5 1c49739edd71f83f2adbb770616bfb41
SHA1 83b0ee79f63f6ec24360197e20cbac24ae02b688
SHA256 0ace9ef559a167d3f36266c036306473a5cc2161ad12294217e2d2061c5a4e0f
SHA512 f3316a96e84a5bcbcb176387540bfc0397855dcf049975d0b1dff44d6bf75a0dcefd34d4e914cd760772ff295d979dd7959b64e0eaaf0e10f7e6039b23b7478e

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_id.dll

MD5 65fb1c07237d63bc38d11a2416c34ba8
SHA1 8eabd2b245511809e00b78b06b1985152dd2578f
SHA256 57b01bc5a7b4e8c656b08c89213278f81ce264cc399999e76733ddd90c580f26
SHA512 e66cba2a1951706186ab1b13b85679d0aef21dbe56bd3c15e0f2e76ba25df15dce0826ea050b40c8e1c05cdbe257f629fe018096bf488c6845b0a9f5cf565e8d

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_hu.dll

MD5 cdff9cdd17e3950f3d274e1be976b2d4
SHA1 41590b06ca7e74db8d286e5952f32f5be47d7abf
SHA256 7cf8997e700cbb81931bc9becf7d0887db7477d97c9f88718c0c2d7849310048
SHA512 e0386fd5e0dbdd4e65fb04a554dc0e3d5ef4f862c685614abbf66e8a14cfaa3d2243e77c3d6d14d56aaf1ae38465aa0762a5c3d32a0ed81605b1c7b3274562e7

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_hr.dll

MD5 846b9b5f9f5ce6d8e1e18b053ccc96e3
SHA1 be17600fb7f1f305158eb735206e1c2a6eddb410
SHA256 10e40940f8dc323c6e1fea3f625de0cf2efaceb266b64e81cfa66a2eb51d1f0d
SHA512 148a48489b2787051074ded3a0f38f03b0b034a8b2b1b991ec833848fdcb307e3c6570d829439dc2205455115aaf166f845866cf7d89a07e011aa8d822e9bcdd

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_hi.dll

MD5 00661e0428373734fa46030533215a12
SHA1 5af1f8606a60dbc8126431d568acc0ab9e48e164
SHA256 4e2b724f581f3eeb2a3bb7c561d635741f515bc01be84c9d6ae245e5c7ddd37b
SHA512 7c7b30ff996d29efacb5877edc6840cf88a7148c7f9f42bae1fc2f142169867fa2a66863a5b01a0096b01ad18d9eb9fe6eeb2653879cc8f7519634bb3c49a133

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_gu.dll

MD5 5ad48f292a34d8a600f3ee5b02664536
SHA1 bdd7bb9e1b730cd63de7e8a50f9c3d76963db4a5
SHA256 faf2d0d88df753be0de3fa0218b78c3582947ead0be012c0af30f863cb3dda2d
SHA512 527c425b5ec64554154bd226bc6488fd4c1af47db67020d865cd1f52400e55c01797a0fd38422278bfc2d481a293902b1cd51a4e5882e3cc6b4ebc223384c38f

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_gl.dll

MD5 4ce45acdc229b38aac0b4849c1f18d94
SHA1 d43eec8a4f689be874541a0c0e6859d3acd78a95
SHA256 cb37f5288928cf0a89f7711366b70c943f7e6ade43e73b8bfee5e1660cc54032
SHA512 43a0c7eaf20b3827d8a33b1fb696cf9d3eb596b975b24175cbbd28090fcfb090d6bedd59d2d63514c9ff334d1bb0ceaeb77b61c632f9bb8666346abc1b384945

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_gd.dll

MD5 0be6761d833c240b79c092afa2f4d4a0
SHA1 3f13b2fb19489bba686cd681b00d6178a2ce9923
SHA256 248bb8fba661f7b7d4045331d1e4ad808ffe8f446f732c14d2f3a6857f0ebd4e
SHA512 1ec9596ce5ada65ba5739ed11c7554133217d9352913e109012f07d810883080d613e057ea75df6c4cd6a4150e669e55c5100b07026073e9bab68af44974e56c

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_ga.dll

MD5 d6ef74d45d1dd95d9c3c07abc6ec2b85
SHA1 8a161184979d02361688f4214a415ee909c58401
SHA256 f595794586d38fd55bee18c9dbd21c87d33dfc0d03dfe87ade8b0bef5e97252e
SHA512 3f74f4c47757b3a0c6969dc1e9ccccc6c03161014184232430cadac4c85a8fb0748d6f894e99b169d4fcc8190d5cd20ff03157e0d155c3c6e40d4a212e981cdb

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_fr-CA.dll

MD5 f5c88d98f81d525185f5ad8ce5572e86
SHA1 5cd1375cc42a430aec940e4d73b90748890abc79
SHA256 6f6eef8c4afb0deee2497a55854f10407a69dd76e2211c83dc33546f6917a7ad
SHA512 ce41a2dcaa35145e4a638af9e70d3efb9ae5ba8357d0ad3762ab2dd5ed7a1bf141efa83ad9922e0aa11d73521d498226e83515b0166611e7ce1c81f0be9d4ba2

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_fr.dll

MD5 24d190e6f80c7a09dd0ea52db8dc3495
SHA1 02997fc50123612e7100aeca728153b62de8ca52
SHA256 f3cfc3eecf03e256dd6df7d95fae127a4e2c86f3dce58545ae16c422fa8f562b
SHA512 0b5f2c59c3e740c70308174757015f25412f64643abd6fc7965dbc4cc1fd8540a06550b983b62d70dc77cbfdcffc4475143436eef76a07ecb23485bbab054f03

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_kn.dll

MD5 055a4f614d8056ae16ff91959a0f3570
SHA1 48cbb61f7f6bdf5399cb9aa0f512b78a57ba1e18
SHA256 458ede85c40745a5f79201bbc8b0785549e2c13be8ec726d32e4ff2e052db27a
SHA512 2e2991582c5d0776880063052d483feae79d7d97a45580465e134c517b080fe7761410de8401722dbfaa3211aa7ac1cbb030d5002e544fd196735bad3706767a

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_fi.dll

MD5 8f5be4d7e225f2cbf66f3960b56502d0
SHA1 f43fe1f55007dda26ebf78711ebbfb512390b7ed
SHA256 a121a308be48878337fe8c68a45aa10ca898e39c2d195ef244bb657755327366
SHA512 f92088d7babe2d0f4eee14e16f6d67fab8225dff0d3798b1c47f5a291cc9b820c2a7a0c2eecaa97850fa6998e260932941364b100eb8047e5e4bc9e1432a3c06

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_fa.dll

MD5 3aa4579d9819617c80568f1f2cb1e287
SHA1 271fa4f97b32d76fa890c4cb9c30ddb2e0298152
SHA256 77b558ba96080390a79ec321af1579b1d17b7179e8a893e10462c7b22c8e8a5e
SHA512 aecf49ff9385947cd7b5c9c0626015c36b106ef6482ecc47c8c189e5d9e4d670ef119e47302accab93214e6b70e9641aebac552d0b2cde4ef4ac252d3ee8d465

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_eu.dll

MD5 e3db9c5ec70ac6c8bf69272f3596c7bb
SHA1 815d877bfe2dcf83a5387da48c3e7534c97f0bb8
SHA256 0aaa5b02f2541fdbea4357155e3ff28c4d715994646364fb9cff591c27c8150a
SHA512 b6d283923b7ad531014f9113dc95c8484deb76cfffd738f223057839de0b163053b5fbb2447fda238369275637870b3e5e911b8f4ab04e4115b6ce7a7f84cd5a

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_et.dll

MD5 bd8f9362d99be154cdd697b8120e096d
SHA1 c15f2533bd74320a85cafe96b37947bdc3d7cdb3
SHA256 49424f739809b3d7fe874852420cd91752cfa605005bf6186c9f89b1b704f40e
SHA512 69341c9521488c26b16740e9a5501ee6f0a95689d14aa3806df06bf1a21e9b902743e24d3d169a66b5a19c28a6c9217538162ce4fa6b2b3f658e276327de34d9

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_es.dll

MD5 19d6139c5aa6162e8a2a8ba17ec81822
SHA1 d81f95f5e4021c4ef9b9781d32a729782eeccbbe
SHA256 f9ba82d35d780cf5b4819570e81933b06da524eacb5d0eebeef4276aafb9c96e
SHA512 7b287470db50e78bebe8c0906d5f0ccf3aa2c20f70948f7074a8dad29eef40d850c996a790eccdef6ec3d5271a22a5100cb96720966cf0fc032c139e42e10e37

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_el.dll

MD5 f9bbe44306e396b4f5828033d4a8e129
SHA1 2db819ba55ceaa502f7158159d1d6c3de8844ccc
SHA256 3723b0bb625284d49824ab7689721e180238e0c693fb41d9948920210fb171ce
SHA512 608e1122641ff864627d144925d853bfedb7704cda6bef9257d6ae2a6c5d6eb4e2ef773f717cfab1f9c463b17997acf8762b08ac24412ea898e4cd690809d1fb

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_de.dll

MD5 88580c499f109cef95f3020b64266097
SHA1 da6cd858d8e9715a82a792da35a4c97b76e341a4
SHA256 444f87c7ab5a89e3d423b497abf05fe22ae4605569abd83f3925d3a50a74cd08
SHA512 1838d59b0e414b68b785646b01c8c5f6ebf0466e59c946ebf845782edeca76a396609ef2742341b4d89fad58468d9f0e0e24492be78255ac71a3e0e963e1c999

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_cy.dll

MD5 eafbe4b540d5717792cf9e1107aaba90
SHA1 99daa2697b99139c966e58d8e89a64667a9015b3
SHA256 a12771439505f2d419b246d6a974fe8937e0aa5d3b1f9863dbae9f4b7e6197c8
SHA512 d89ca2292190b5914b92f11087970910d18b5e60bbc853466d2439b84612f74248f57b8347c48ee3b1f11232771f99ddb07229cec4beb206bcb1bcee68e6183b

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_cs.dll

MD5 ea83abf1891a11ff03172d0473a64923
SHA1 a19f2e3a26467d8dba5eb73194be1becd0f5563b
SHA256 8a981d1abbd9c6454d2798c7df5708e4af44f54991ac06e988e4e66022c15489
SHA512 f717431b7fca156a476059525307c7f82c74570b1b9c41d6596af14a340d8b3c26493f962c4f4cbfef0d6971d47822e91111ce2f1204c7127a6f6503942bb39c

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

MD5 acfd43f9fb09dc5e05842bb8dfa5b3c5
SHA1 e673afb66da1f0065bee5da6d52ea9af75e7ecec
SHA256 e703d0fe2e49eef7b8a072830e76143281039527d9c2873c8162f18217b0ed5a
SHA512 df2416d672f059451607a6aa5752bdfce1989fc461f3781033ae8b000941ecc2a29920e7c2c61f7f879cc2a9a63aceb390b627aa602506833ae41f8e574c66aa

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_ca.dll

MD5 a1f2eb33a406b65da04306f52686d6df
SHA1 1a5314c97f23df4ced0466c46aca61286f87d9d2
SHA256 d75877f6cc1b4be175872e8d33778721e3e5acfe1a1154772a68c799f2e3ee1a
SHA512 4d0bfaf9fa80cf308c629eddee7a850dd485d36753fa5c0825b05dd680998aba96eaad7835de1ddea357a124bf5107d3f10b1b71c0ba4fecdc4fc362b6f326f2

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_bs.dll

MD5 cfdfa919f3f9b33b9e75f9e22a023063
SHA1 2bcfdf9abfe7c13b8883da19cb973da2156a93c2
SHA256 4d2ad964da1441bb08800618db62f9e8117751a4a78bdfa3ae1c2dcf903d6d43
SHA512 42481f9700d2afa9d28d7d4d1d1937e1acd569b3039230fb6d7c52de12d473e708324d1cd285985186e2531831004d5ec2b801f48a0ce3dbf53549fb88ac7793

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_bn-IN.dll

MD5 c00dd2c1ada230d747f4914e569a4766
SHA1 3c71082db0a88876fd0c929cbf2e25969669c395
SHA256 19fecbe5aa1f007f5f4ed719ad474b3270603c1535f187067c30ceddd4444091
SHA512 5a33f9b756ed41251f4e85a2b85489c679c350e2838e07b1df00b17f655f73d4b16783cbd4031863fb9c9851815ebbd5bb1f58c465e7d88a41d642d0118530c0

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_bn.dll

MD5 f010d0ef5fa1c42df991e6a0dd63ea85
SHA1 ebb19b0804b99f55c41754bfc43d654b87f86b14
SHA256 97e41d2acb8b638ac2a039da4f9750a0e9387ac10433cb68e0415c0093695ce0
SHA512 31fcca5c46be1967696fc9b3e9d23a4d81700fea64a826245b674dd1a0c4571a4515ceec6e9fc7d3c9d6bb2a7b7139082bded78847d614917e605b806597ce84

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_az.dll

MD5 f4c8a5f7bc960a03ddf8b74dfae1b060
SHA1 74ee2f8420d86652cb4be3b72dadd52c31ee6689
SHA256 3ccf9900953a871a129280260909acfc20aa23644181e354847fbe6b2e005110
SHA512 c9c1b64a5da33130be847f0f2e5acee2af78ec84df14c873d1413a495c40a84c318435c43b5e17ccb0fe2929cc97350bef882b68632f1a80551c0e79ff2bcdcd

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_as.dll

MD5 7b0f190cfa90f9cfcac3f22644b03559
SHA1 de5aa579ead3696433d5509d922fab6fc4954746
SHA256 68a495ee65652ebb55f856b7a82dde20fdda0b38880019170fa5cbafb336c123
SHA512 62572ed3b1cef8d8aac514c9224c4b44546b4c935ab141eeaa696a69caa88b3525199d75fd2f5edaf15fae07b354a7c5e7df86d50dbc50cc093448640b95fdae

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_ar.dll

MD5 b09436f36b5a4a81a153984bbf3fddfc
SHA1 6939928c6c5cfa89525e728b541568869de2804b
SHA256 b4e66f907dde78b4d4f85c5c44656667b7b0fa0659eb56f7f96d974cb66d4dd0
SHA512 472798b8419b2e6614c72eac27bd3c3a2ac0d93b3a15c992d26d44f1ee3f628406a405df36145bdeeee45b2e96b2def9058869dd2dc857030ae7972e0b0bcf52

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_af.dll

MD5 91295713d791ad6378b117d020c63444
SHA1 0055846b91740c4631026affb5c044b1261e53a8
SHA256 41d0565075327e4a0d1364eb556a238981659f063054404458c0b7b37ec64574
SHA512 55fbbe74bf45ff9700d5a3b940aac9992625a994bc64f842560a0c15e9a8f85a9cb51db993fc43b412608089d3ed6078a8a81afcba33e7e0b0d9b72a4a5b0358

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\EdgeUpdate.dat

MD5 369bbc37cff290adb8963dc5e518b9b8
SHA1 de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
SHA512 4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\NOTICE.TXT

MD5 6dd5bf0743f2366a0bdd37e302783bcd
SHA1 e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
SHA512 f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeComRegisterShellARM64.exe

MD5 80779f870e88307143083fcf97f251b4
SHA1 e299c63a8745ab0a46cae731514f936f9714d622
SHA256 8a75eaf5677dc11b1c37fbf57ca354b0e3d25c8aa867269c2deb0e7fb7fa0693
SHA512 a1f56f0706cf7cbd35d74840ed58c685f3bf86e35efcbd73ae2d73ca6ce9a8ad1f7ced8528b3d81785e3bb9297023bf42f8e60bc4631232d9947cdbeb56afb47

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

MD5 f87a4644fd6dc581ef7b67062fdb55ba
SHA1 38feeaf764e787bd68c06fe243c6064f130b8eab
SHA256 1c2fd257dfc2c3967f7afc0ee726319cb6eaa0f1db86c34f97d703ce7bdcb5eb
SHA512 1f054a7111c9d7576ca80b3102670786f8d44276d36446c96f1c8f6aa7f51aa4d81edd4cc36a33cbffeba6d5b6b313f5de0e4209f6edbfe291958b2022677125

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\MicrosoftEdgeUpdateCore.exe

MD5 08e9b96eb44be746d65eae418abeb20b
SHA1 eb86e91462752a1187d73cf678671bbe34d16dad
SHA256 39f7c35da1df0dca19b5bc426f0687ff0f8ae8de3ae997857a4672f1176de161
SHA512 70e08d09ef398eefbace3bce84e6b6c3e55b6caad8886002fd89466e455e6ffecbfca8d233f47de5cd99a5f6805952726676c8545c7d4884209355a48a34d396

C:\Program Files (x86)\Microsoft\Temp\EU5A16.tmp\msedgeupdateres_am.dll

MD5 f18d85b1e1c45b935e0003f1dbb912f0
SHA1 ba3da8ed55807f6dbb8641620e2594b245e80ced
SHA256 2fa5350047962335602e7a450d1e29951609487e997bf183ce0eb5d01b28f066
SHA512 7a0a22a7efe14f8f8541dd5d59a355d6b601ab3aed2d7ab3895e31d4a1c6531b199243223a3b001dad06186c1f4eca882966c197f2c05256c9f73d8ba96e50bc

C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

MD5 6bf39fa9127351032dd9600e0286c23e
SHA1 885d0e84fd652ee07d8fc828f681bec005fedb0c
SHA256 79897004b14f93ac66c90463ff1a840b7d2fe58c4ea00b881a7af357b733fb72
SHA512 2159439e28085485692afa84b48dd72edcffd1307dc63d20977bd04966817c2da061e56e9680649560869781d7606f02ef8a67f2ca03b2cf8b224e32f0d6c830

memory/928-519-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2336-521-0x00000000008C0000-0x00000000008F5000-memory.dmp

memory/928-520-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3752-523-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2336-522-0x0000000074480000-0x000000007469F000-memory.dmp

memory/928-524-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3752-527-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3752-530-0x0000000000400000-0x000000000041B000-memory.dmp

memory/928-531-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2336-533-0x00000000008C0000-0x00000000008F5000-memory.dmp