Malware Analysis Report

2024-07-28 12:16

Sample ID 240613-3pgbcszblp
Target a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118
SHA256 16571e6da1e5261d7a97e8f1bddd953dd2cb4e94cf67e378376521ef675fa6f7
Tags
ramnit banker spyware stealer trojan upx worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

16571e6da1e5261d7a97e8f1bddd953dd2cb4e94cf67e378376521ef675fa6f7

Threat Level: Known bad

The file a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

ramnit banker spyware stealer trojan upx worm

Ramnit

UPX packed file

Executes dropped EXE

Checks computer location settings

Deletes itself

Loads dropped DLL

Drops file in System32 directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Program crash

Uses Volume Shadow Copy WMI provider

Checks processor information in registry

Modifies Internet Explorer settings

Modifies data under HKEY_USERS

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Uses Volume Shadow Copy service COM API

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-13 23:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 23:41

Reported

2024-06-13 23:43

Platform

win7-20240508-en

Max time kernel

149s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe"

Signatures

Ramnit

trojan spyware stealer worm banker ramnit

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqwmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqwSrv.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\config\systemprofile\Favorites C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\DNTException\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69DC3361-29DE-11EF-BA28-C2931B856BB4}.dat C:\Program Files\Internet Explorer\iexplore.exe N/A
File created C:\Windows\SysWOW64\ccyqqwmgr.exe C:\Windows\SysWOW64\ccyqqw.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440\msapplication.xml C:\Program Files\Internet Explorer\iexplore.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk C:\Windows\System32\ie4uinit.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ieonline.microsoft[1] C:\Program Files\Internet Explorer\iexplore.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69D9D201-29DE-11EF-BA28-C2931B856BB4}.dat C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File opened for modification C:\Windows\System32\config\systemprofile\Favorites\Links C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Windows\System32\ie4uinit.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69D50F41-29DE-11EF-BA28-C2931B856BB4}.dat C:\Program Files\Internet Explorer\iexplore.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{69DC3363-29DE-11EF-BA28-C2931B856BB4}.dat C:\Program Files\Internet Explorer\iexplore.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440\msapplication.xml C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch C:\Windows\System32\ie4uinit.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69DC3361-29DE-11EF-BA28-C2931B856BB4}.dat C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69D50F41-29DE-11EF-BA28-C2931B856BB4}.dat C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\Favorites\Links\Suggested Sites.url C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch C:\Windows\System32\ie4uinit.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\TabRoaming C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatCache\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69D50F41-29DE-11EF-BA28-C2931B856BB4}.dat C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~ C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69D9D201-29DE-11EF-BA28-C2931B856BB4}.dat C:\Program Files\Internet Explorer\iexplore.exe N/A
File created C:\Windows\system32\config\systemprofile\Favorites\Links\Suggested Sites.url C:\Program Files\Internet Explorer\iexplore.exe N/A
File created C:\Windows\SysWOW64\ccyqqwSrv.exe C:\Windows\SysWOW64\ccyqqw.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\TabRoaming C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatCache\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Windows\System32\ie4uinit.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\TabRoaming C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\DNTException\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69D50F41-29DE-11EF-BA28-C2931B856BB4}.dat C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\SysWOW64\ccyqqw.exe C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk C:\Windows\System32\ie4uinit.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\DNTException\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatCache\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69D9D201-29DE-11EF-BA28-C2931B856BB4}.dat C:\Program Files\Internet Explorer\iexplore.exe N/A
File created C:\Windows\SysWOW64\ccyqqw.exe C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Windows\System32\ie4uinit.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{69D50F43-29DE-11EF-BA28-C2931B856BB4}.dat C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~ C:\Program Files\Internet Explorer\iexplore.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\px17C5.tmp C:\Windows\SysWOW64\ccyqqwSrv.exe N/A
File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Windows\SysWOW64\ccyqqwSrv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\px16FA.tmp C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe N/A
File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\ccyqqw.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\ccyqqw.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424483960" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{69B15AA1-29DE-11EF-BA28-C2931B856BB4} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{69C22B51-29DE-11EF-BA28-C2931B856BB4} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{69C20441-29DE-11EF-BA28-C2931B856BB4} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-000000000046} C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\Flags = "512" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore\Count = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\LoadTimeArray = 16000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-b9-b0-30-a5-b2 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\Type = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore\Flags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\LinksBar\MarketingLinksMigrate = 60b0742cebbdda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\Software\Microsoft\Internet Explorer C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{69D9D201-29DE-11EF-BA28-C2931B856BB4} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E8F05F8F-08BA-40DE-93BD-80EE08D70B30}\56-b9-b0-30-a5-b2 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-b9-b0-30-a5-b2\WpadDecision = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E8F05F8F-08BA-40DE-93BD-80EE08D70B30}\WpadNetworkName = "Network 3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\Count = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore\Time = e807060004000d00170029000c005800 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Setup\HaveCreatedQuickLaunchItems = "1" C:\Windows\System32\ie4uinit.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2300000023000000430300007b020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\Time = e807060004000d00170029000c002900 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-b9-b0-30-a5-b2\WpadDecisionTime = e069a954ebbdda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\Flags = "512" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E8F05F8F-08BA-40DE-93BD-80EE08D70B30}\WpadDecisionReason = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\VerCache = 0086a9a807ccca010086a9a807ccca01000000009093660000000e00e803991200000e000000991209040000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Zones C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\KnownProvidersUpgradeTime = 604a8a40ebbdda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E8F05F8F-08BA-40DE-93BD-80EE08D70B30}\WpadNetworkName = "Network 3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-000000000046}\Enum\Implementing = 1c00000001000000e807060004000d00170029000f008b0100000000 C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021494-0000-0000-C000-000000000046}\Enum C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore\Type = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqwmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqwmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqwSrv.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqwSrv.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqwSrv.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqwSrv.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqwmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqwmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqwmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqwmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqwmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqwmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A
N/A N/A C:\Windows\SysWOW64\ccyqqw.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ccyqqwmgr.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ccyqqw.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1872 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
PID 1872 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
PID 1872 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
PID 1872 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
PID 1872 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe
PID 1872 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe
PID 1872 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe
PID 1872 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe
PID 2612 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 2612 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 2612 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 2612 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 2572 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2572 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2572 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2572 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2156 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2156 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2156 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2156 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2156 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2156 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2156 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2156 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2648 wrote to memory of 2752 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2648 wrote to memory of 2752 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2648 wrote to memory of 2752 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2648 wrote to memory of 2752 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2556 wrote to memory of 2476 N/A C:\Windows\SysWOW64\ccyqqw.exe C:\Windows\SysWOW64\ccyqqwmgr.exe
PID 2556 wrote to memory of 2476 N/A C:\Windows\SysWOW64\ccyqqw.exe C:\Windows\SysWOW64\ccyqqwmgr.exe
PID 2556 wrote to memory of 2476 N/A C:\Windows\SysWOW64\ccyqqw.exe C:\Windows\SysWOW64\ccyqqwmgr.exe
PID 2556 wrote to memory of 2476 N/A C:\Windows\SysWOW64\ccyqqw.exe C:\Windows\SysWOW64\ccyqqwmgr.exe
PID 2556 wrote to memory of 2464 N/A C:\Windows\SysWOW64\ccyqqw.exe C:\Windows\SysWOW64\ccyqqwSrv.exe
PID 2556 wrote to memory of 2464 N/A C:\Windows\SysWOW64\ccyqqw.exe C:\Windows\SysWOW64\ccyqqwSrv.exe
PID 2556 wrote to memory of 2464 N/A C:\Windows\SysWOW64\ccyqqw.exe C:\Windows\SysWOW64\ccyqqwSrv.exe
PID 2556 wrote to memory of 2464 N/A C:\Windows\SysWOW64\ccyqqw.exe C:\Windows\SysWOW64\ccyqqwSrv.exe
PID 2464 wrote to memory of 2912 N/A C:\Windows\SysWOW64\ccyqqwSrv.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2464 wrote to memory of 2912 N/A C:\Windows\SysWOW64\ccyqqwSrv.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2464 wrote to memory of 2912 N/A C:\Windows\SysWOW64\ccyqqwSrv.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2464 wrote to memory of 2912 N/A C:\Windows\SysWOW64\ccyqqwSrv.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2476 wrote to memory of 2276 N/A C:\Windows\SysWOW64\ccyqqwmgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2476 wrote to memory of 2276 N/A C:\Windows\SysWOW64\ccyqqwmgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2476 wrote to memory of 2276 N/A C:\Windows\SysWOW64\ccyqqwmgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2476 wrote to memory of 2276 N/A C:\Windows\SysWOW64\ccyqqwmgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 624 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\System32\ie4uinit.exe
PID 2912 wrote to memory of 624 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\System32\ie4uinit.exe
PID 2912 wrote to memory of 624 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\System32\ie4uinit.exe
PID 2476 wrote to memory of 2112 N/A C:\Windows\SysWOW64\ccyqqwmgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2476 wrote to memory of 2112 N/A C:\Windows\SysWOW64\ccyqqwmgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2476 wrote to memory of 2112 N/A C:\Windows\SysWOW64\ccyqqwmgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2476 wrote to memory of 2112 N/A C:\Windows\SysWOW64\ccyqqwmgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2112 wrote to memory of 1232 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\System32\ie4uinit.exe
PID 2112 wrote to memory of 1232 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\System32\ie4uinit.exe
PID 2112 wrote to memory of 1232 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\System32\ie4uinit.exe
PID 2276 wrote to memory of 2408 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\System32\ie4uinit.exe
PID 2276 wrote to memory of 2408 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\System32\ie4uinit.exe
PID 2276 wrote to memory of 2408 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\System32\ie4uinit.exe
PID 1872 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1872 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1872 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1872 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2112 wrote to memory of 1200 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2112 wrote to memory of 1200 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2112 wrote to memory of 1200 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe

C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe

C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe

C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\SysWOW64\ccyqqw.exe

C:\Windows\SysWOW64\ccyqqw.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:2

C:\Windows\SysWOW64\ccyqqwmgr.exe

C:\Windows\SysWOW64\ccyqqwmgr.exe

C:\Windows\SysWOW64\ccyqqwSrv.exe

C:\Windows\SysWOW64\ccyqqwSrv.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\System32\ie4uinit.exe

"C:\Windows\System32\ie4uinit.exe" -ShowQLIcon

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\System32\ie4uinit.exe

"C:\Windows\System32\ie4uinit.exe" -ShowQLIcon

C:\Windows\System32\ie4uinit.exe

"C:\Windows\System32\ie4uinit.exe" -ShowQLIcon

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A7258A~1.EXE > nul

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2680 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.bing.com udp
CN 123.249.27.213:8080 tcp
US 8.8.8.8:53 api.bing.com udp
CN 123.249.27.213:8080 tcp
CN 123.249.27.213:8080 tcp
CN 123.249.27.213:8080 tcp
CN 123.249.27.213:8080 tcp
CN 123.249.27.213:8080 tcp
CN 123.249.27.213:8080 tcp

Files

memory/1872-0-0x0000000000400000-0x000000000045C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe

MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe

MD5 dfb5daabb95dcfad1a5faf9ab1437076
SHA1 4a199569a9b52911bee7fb19ab80570cc5ff9ed1
SHA256 54282ec29d4993ed6e9972122cfbb70bba4898a21d527bd9e72a166d7ec2fdc0
SHA512 5d31c34403ab5f8db4a6d84f2b5579d4ea18673914b626d78e458a648ac20ddd8e342818e807331036d7bb064f596a02b9737acac42fbead29260343a30717e8

memory/1872-15-0x0000000000360000-0x00000000003BB000-memory.dmp

memory/2572-30-0x0000000000400000-0x000000000042E000-memory.dmp

memory/2572-28-0x0000000000240000-0x0000000000241000-memory.dmp

memory/2156-21-0x0000000000400000-0x000000000045B000-memory.dmp

memory/2612-20-0x0000000000400000-0x000000000042E000-memory.dmp

memory/1872-19-0x0000000000220000-0x000000000024E000-memory.dmp

memory/1872-17-0x0000000000360000-0x00000000003BB000-memory.dmp

memory/2156-31-0x0000000000320000-0x0000000000321000-memory.dmp

memory/2156-33-0x0000000000330000-0x0000000000331000-memory.dmp

memory/2156-32-0x0000000000400000-0x000000000045B000-memory.dmp

memory/2476-60-0x00000000003F0000-0x00000000003F1000-memory.dmp

C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

MD5 88f7a3be05d963c1b806ddbc7135ca8c
SHA1 cac3eaf79d44c4267024d576fcd7ca1ebe802d26
SHA256 26c511995921ce38781848bbfd17f18c3bcbb799f576fc72370dff3485fa14a0
SHA512 dfff2f34cbe088714707d3631080b7296ba46d37f7277d5c3d3f04b29933c059ff63c2d39ee48a4e8b79444e488e169a41cdb0a9faab1a803f092cd1a68e05ed

C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

MD5 45746b5317d380078febe04385b81405
SHA1 e6b9a47deab744c12125936c5e5abb3e07b87fe8
SHA256 a42b05c8ba93f4f590f5f367118f4850dff4f3ec3a4a5e1aecce87a9ae4d5511
SHA512 caf91351c5590922a9a3faa41f5ebc82b450208a486a7a1cee32c140c2290f8890bcdd216371cfe5135e5cc0cfeca323b1d3a09973cd415239b1f7959af28098

memory/2464-59-0x0000000000400000-0x000000000042E000-memory.dmp

memory/2476-56-0x00000000003E0000-0x00000000003E1000-memory.dmp

memory/2464-54-0x0000000000400000-0x000000000042E000-memory.dmp

memory/2556-53-0x00000000001B0000-0x00000000001DE000-memory.dmp

memory/1872-52-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2476-51-0x0000000000400000-0x000000000045B000-memory.dmp

memory/2556-48-0x00000000001B0000-0x000000000020B000-memory.dmp

memory/2556-37-0x0000000000400000-0x000000000045C000-memory.dmp

C:\Windows\SysWOW64\ccyqqw.exe

MD5 a7258abe54185fa9651fd4c0ac03fefa
SHA1 7ca46de7d75de921d10cbeb07a8a91ec03cdc636
SHA256 16571e6da1e5261d7a97e8f1bddd953dd2cb4e94cf67e378376521ef675fa6f7
SHA512 43146037f16c74c683bdc53f7c24a0fcbb10a76821e84097910a6af72da52e611677256201d978f9f0773d8216e9d2a4b5ae4f91cb23122208acebe216816848

memory/2156-34-0x0000000000400000-0x000000000045B000-memory.dmp

C:\Windows\System32\config\systemprofile\Favorites\desktop.ini

MD5 881dfac93652edb0a8228029ba92d0f5
SHA1 5b317253a63fecb167bf07befa05c5ed09c4ccea
SHA256 a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464
SHA512 592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69D50F41-29DE-11EF-BA28-C2931B856BB4}.dat

MD5 595230d35ea439306ad84fb6c21e36b9
SHA1 7622a87c12d102a2a210a288c9bc8b5d13370045
SHA256 8c3ca5ae3147acbb08165abde9a30197f896046797b9ca099942d21236c96742
SHA512 f84080bc99255e8e20e8d9b1381b3892b4ee55146741c5dce15a450d748f6e61a4e53970911048db67a8b5dce1cb0142fa41131bb378095d9a292d55cc7f7bad

C:\Windows\System32\config\systemprofile\Favorites\Links\Suggested Sites.url

MD5 2578ef0db08f1e1e7578068186a1be0f
SHA1 87dca2f554fa51a98726f0a7a9ac0120be0c4572
SHA256 bdc63d9fd191114227a6e0ac32aaf4de85b91fc602fcb8555c0f3816ac8620b3
SHA512 b42be0e6f438362d107f0f3a7e4809753cf3491ab15145f9ffa4def413606243f4dfffc0449687bd1bb01c653e9339e26b97c286382743d14a2f0ed52e72f7ee

C:\Windows\System32\config\systemprofile\Favorites\Links\desktop.ini

MD5 3c106f431417240da12fd827323b7724
SHA1 2345cc77576f666b812b55ea7420b8d2c4d2a0b5
SHA256 e469ed17b4b54595b335dc51817a52b81fcf13aad7b7b994626f84ec097c5d57
SHA512 c7391b6b9c4e00494910303e8a6c4dca5a5fc0c461047ef95e3be1c8764928af344a29e2e7c92819174894b51ae0e69b5e11a9dc7cb093f984553d34d5e737bb

C:\Windows\Temp\www1A36.tmp

MD5 2ce792bc1394673282b741a25d6148a2
SHA1 5835c389ea0f0c1423fa26f98b84a875a11d19b1
SHA256 992031e95ad1e0f4305479e8d132c1ff14ed0eb913da33f23c576cd89f14fa48
SHA512 cdcc4d9967570018ec7dc3d825ff96b4817fecfbd424d30b74ba9ab6cc16cb035434f680b3d035f7959ceb0cc9e3c56f8dc78b06adb1dd2289930cc9acc87749

C:\Windows\System32\config\systemprofile\Favorites\Links\Suggested Sites.url

MD5 11cede0563d1d61930e433cd638d6419
SHA1 366b26547292482b871404b33930cefca8810dbd
SHA256 e3ab045d746a0821cfb0c34aee9f98ce658caab2c99841464c68d49ab2cd85d9
SHA512 d9a4cdd3d3970d1f3812f7b5d21bb9ae1f1347d0ddfe079a1b5ef15ec1367778056b64b865b21dd52692134771655461760db75309c78dc6f372cc4d0ab7c752

C:\Windows\Temp\www1A35.tmp

MD5 a1fd5255ed62e10721ac426cd139aa83
SHA1 98a11bdd942bb66e9c829ae0685239212e966b9e
SHA256 d3b6eea852bacee54fbf4f3d77c6ec6d198bd59258968528a0231589f01b32f4
SHA512 51399b4eac1883f0e52279f6b9943d5a626de378105cadff2b3c17473edf0835d67437ae8e8d0e25e5d4b88f924fa3ac74d808123ec2b7f98eff1b248a1ab370

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69C20441-29DE-11EF-BA28-C2931B856BB4}.dat

MD5 fe6d498d8b0ba5e39e488dea7d774baf
SHA1 c6b246fed06433ee6ba32f197f8d0ecb46740f54
SHA256 fb6ad4760265fc9fd0b11f56a48a4d849eb25c99496930e27a36aafcead8114a
SHA512 468692f764ee6fb30ceacd691fa30913534d35af495c8ef4a7b341208a2ce09130f912cc84ab94ebeaf194f74f06b5fa2f65b5746a8d27053f281fa3b40c1d03

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{69C22B51-29DE-11EF-BA28-C2931B856BB4}.dat

MD5 a050eecf95ef1762be8ba8211f52453e
SHA1 809eb51441853dd863b5879fb14e037fdcfcacf4
SHA256 ef9e054bb079950dce93cedb81f03f2f81d4d0a21ec8193e9f863a9a59f244e4
SHA512 9f42c1f8d4587ab0f514286c51aa4def823b76d2d675687fe38ec5cb8b3123b2fe38a6c6afa82310e058fcc58598ccf156c7f6efe57319768f006c9e63227982

memory/2156-157-0x0000000000400000-0x000000000045B000-memory.dmp

memory/2556-159-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2556-160-0x00000000001B0000-0x00000000001DE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 23:41

Reported

2024-06-13 23:43

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe"

Signatures

Ramnit

trojan spyware stealer worm banker ramnit

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqcmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqcSrv.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\bc0f76f2-2381-4502-ae6b-dd23e6714796.tmp C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\1b5643ec-d9b2-4091-9594-5dc31dcf7498.tmp C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase\LOCK C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\d5785d41-dab9-487c-a539-7e3a73e7e687.tmp C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\DNTException\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-journal C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\temp-index C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\21cba8b6-b6a8-44cd-9320-b1e72b80451c.tmp C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\PrivacIE\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics.pma C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\CURRENT C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data-wal C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase\LOCK C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\LOG C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\SysWOW64\cqskqc.exe C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{6A5B6454-29DE-11EF-A084-C2748A3A93CE}.dat C:\Program Files\Internet Explorer\iexplore.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\MANIFEST-000001 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\LOCK C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\MANIFEST-000001 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_model_and_features_store\LOCK C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\TabRoaming C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\9cb5f596-b177-4df6-8035-e776bf13c291.tmp C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SysWOW64\cqskqcmgr.exe C:\Windows\SysWOW64\cqskqc.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\a9bbe3cf-5b2d-4a34-a8ef-2308bcafcc13.tmp C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_2 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\FirstLaunchAfterInstallation C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\a9bbe3cf-5b2d-4a34-a8ef-2308bcafcc13.tmp C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\First Run C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB\LOCK C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data-journal C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State~RFe578608.TMP C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low C:\Program Files\Internet Explorer\iexplore.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOCK C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe57731d.TMP C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\download_cache C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\MANIFEST-000001 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOCK C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft\px4508.tmp C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe N/A
File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\px4585.tmp C:\Windows\SysWOW64\cqskqcSrv.exe N/A
File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Windows\SysWOW64\cqskqcSrv.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\55b8b142-abf1-4bc6-9e99-895d12bce643.tmp C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20240613234116.pma C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\cqskqcmgr.exe

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\cqskqc.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\cqskqc.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6A3C6654-29DE-11EF-A084-C2748A3A93CE} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424483950" C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\edge.services.last_username = "8E15851CBBAD3DFA04F8E33E349C8AD2BAED550D2960D363F55E21CAC3914A71" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021494-0000-0000-C000-000000000046}\Enum\Implementing = 1c00000001000000e807060004000d00170029001400b10200000000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\StabilityMetrics C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\BLBeacon\version = "92.0.902.67" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31112717" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\edge.services.account_id = "C87012B88178D73EA4C51CF29C811DE25BEC5CD54D94E21518054163AF9B72E2" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings\mhjfbmdgcfjbbpaeojofohoefgiehjai = "4BCE1FE81CEA9938458CBE050C9BE1EFF716AFCCF3838EED2975D20D84D242F3" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\MSEdgeMHT_.mhtml = "0" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\session.restore_on_startup = "D03EFD52E63E5932133A7A83FA6AD1DABE083A8DE72375AE66ECF9EBA5A07611" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\IEToEdge\UpsellDisabled = "0" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\settings_reset_prompt.last_triggered_for_homepage = "26D14181F0E3E3C8B648EE8AE336F479D2300F24D82C997ED4223BD8EC3B553B" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Feeds\MUID C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\StabilityMetrics\user_experience_metrics.stability.exited_cleanly = "0" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\.DEFAULT C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\OperationalData = "8" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\browser.show_home_button = "201AA4D916E6FABF532952782E2A226E593F6B2022A8DE5BDA822B4A838B6E39" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\AppXcc58vyzkbjbs4ky0mxrmxf8278rk9b3t_.xml = "0" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\MAO Settings C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Feeds\MUID C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithProgids C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000025211fa19d5026448d80ded9f423a63d000000000200000000001066000000010000200000007bea52c4aa4c57f37f4d32e5ebed684e50028a5f3a2e3420b8bfa572cd4d8907000000000e80000000020000200000007cdb64ceec55ce567df6fa313bd1379bf787a14444a0f333a5deee469194737c10000000f6a317d4c5cb9330cfc3b89d8234c87a40000000e61d9407c84b6aba854a8a3c41a654a0b45bd92188f169f60476f921cabd1fe1ba34e9701f486d3222e0b266311a44e4464e6d0f8837e04b7360aea650e83699 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\dr = "1" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\edge.services.last_account_id = "3DFD580976E4F6710483AFD04F4EAECF12757A6A24B7D9C8CFBE676BF326AEFD" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\.DEFAULT C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\BLBeacon\failed_count = "0" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\AppX3xxs313wwkfjhythsb8q46xdsq8d2cvv_microsoft-edge-holographic = "0" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\AppX7rm9drdg8sk7vqndwj3sdjw11x96jc0y_microsoft-edge = "0" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\User Preferences C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021493-0000-0000-C000-000000000046} C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021493-0000-0000-C000-000000000046}\Enum\Implementing = 1c00000001000000e807060004000d00170029001000c50101000000644ea2ef78b0d01189e400c04fc9e26e C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000440300007c020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\SmartScreenEnabled C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings\kmendfapggjehodndflmmgagdbamhnfd = "3EF01D7E54A5A792D5A65BB6CBDC48E7AD34EC255E3EFA4FC953CEBF9DD14DB2" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\AppX4hxtad77fbk3jkkeerkrm0ze94wjf3s9_.htm = "0" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\AppXq0fevzme2pys62n3e0fbqa7peapykr8v_http = "0" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqcSrv.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqcSrv.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqcSrv.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqcSrv.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqcSrv.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqcSrv.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqcSrv.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqcSrv.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A
N/A N/A C:\Windows\SysWOW64\cqskqc.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\cqskqc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1792 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
PID 1792 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
PID 1792 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
PID 1792 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe
PID 1792 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe
PID 1792 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe
PID 1032 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 1032 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 1032 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 740 wrote to memory of 1916 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 740 wrote to memory of 1916 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3816 wrote to memory of 3684 N/A C:\Windows\SysWOW64\cqskqc.exe C:\Windows\SysWOW64\cqskqcmgr.exe
PID 3816 wrote to memory of 3684 N/A C:\Windows\SysWOW64\cqskqc.exe C:\Windows\SysWOW64\cqskqcmgr.exe
PID 3816 wrote to memory of 3684 N/A C:\Windows\SysWOW64\cqskqc.exe C:\Windows\SysWOW64\cqskqcmgr.exe
PID 3816 wrote to memory of 4304 N/A C:\Windows\SysWOW64\cqskqc.exe C:\Windows\SysWOW64\cqskqcSrv.exe
PID 3816 wrote to memory of 4304 N/A C:\Windows\SysWOW64\cqskqc.exe C:\Windows\SysWOW64\cqskqcSrv.exe
PID 3816 wrote to memory of 4304 N/A C:\Windows\SysWOW64\cqskqc.exe C:\Windows\SysWOW64\cqskqcSrv.exe
PID 4304 wrote to memory of 452 N/A C:\Windows\SysWOW64\cqskqcSrv.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 4304 wrote to memory of 452 N/A C:\Windows\SysWOW64\cqskqcSrv.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1792 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1792 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1792 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1916 wrote to memory of 1360 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1916 wrote to memory of 1360 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1916 wrote to memory of 1360 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 452 wrote to memory of 2760 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 452 wrote to memory of 2760 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 452 wrote to memory of 2760 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2760 wrote to memory of 1984 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe
PID 2760 wrote to memory of 1984 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe
PID 1984 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1984 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 1964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 1964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4988 wrote to memory of 2580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe

C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe

C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe

C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe

C:\Windows\SysWOW64\cqskqc.exe

C:\Windows\SysWOW64\cqskqc.exe

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\SysWOW64\cqskqcmgr.exe

C:\Windows\SysWOW64\cqskqcmgr.exe

C:\Windows\SysWOW64\cqskqcSrv.exe

C:\Windows\SysWOW64\cqskqcSrv.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3684 -ip 3684

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1896 -ip 1896

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 264

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A7258A~1.EXE > nul

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 260

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:17410 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:452 CREDAT:17410 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=11004a

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=11004a

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7fff4ae546f8,0x7fff4ae54708,0x7fff4ae54718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16282337783097177288,8545124810350403646,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,16282337783097177288,8545124810350403646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,16282337783097177288,8545124810350403646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16282337783097177288,8545124810350403646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2996 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16282337783097177288,8545124810350403646,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16282337783097177288,8545124810350403646,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16282337783097177288,8545124810350403646,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16282337783097177288,8545124810350403646,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16282337783097177288,8545124810350403646,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16282337783097177288,8545124810350403646,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16282337783097177288,8545124810350403646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff708de5460,0x7ff708de5470,0x7ff708de5480

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
CN 123.249.27.213:8080 tcp
US 8.8.8.8:53 api.bing.com udp
N/A 224.0.0.251:5353 udp
CN 123.249.27.213:8080 tcp
CN 123.249.27.213:8080 tcp
CN 123.249.27.213:8080 tcp
CN 123.249.27.213:8080 tcp
CN 123.249.27.213:8080 tcp
CN 123.249.27.213:8080 tcp

Files

memory/1792-0-0x0000000000400000-0x000000000045C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe

MD5 dfb5daabb95dcfad1a5faf9ab1437076
SHA1 4a199569a9b52911bee7fb19ab80570cc5ff9ed1
SHA256 54282ec29d4993ed6e9972122cfbb70bba4898a21d527bd9e72a166d7ec2fdc0
SHA512 5d31c34403ab5f8db4a6d84f2b5579d4ea18673914b626d78e458a648ac20ddd8e342818e807331036d7bb064f596a02b9737acac42fbead29260343a30717e8

C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe

MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

memory/1896-6-0x0000000000400000-0x000000000045B000-memory.dmp

memory/1032-14-0x0000000000550000-0x000000000055F000-memory.dmp

memory/3816-25-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3684-36-0x0000000000400000-0x000000000045B000-memory.dmp

memory/4304-35-0x0000000000400000-0x000000000042E000-memory.dmp

memory/4304-37-0x0000000000490000-0x0000000000491000-memory.dmp

memory/4304-38-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Windows\SysWOW64\cqskqc.exe

MD5 a7258abe54185fa9651fd4c0ac03fefa
SHA1 7ca46de7d75de921d10cbeb07a8a91ec03cdc636
SHA256 16571e6da1e5261d7a97e8f1bddd953dd2cb4e94cf67e378376521ef675fa6f7
SHA512 43146037f16c74c683bdc53f7c24a0fcbb10a76821e84097910a6af72da52e611677256201d978f9f0773d8216e9d2a4b5ae4f91cb23122208acebe216816848

memory/740-19-0x0000000000560000-0x0000000000561000-memory.dmp

memory/740-18-0x0000000000400000-0x000000000042E000-memory.dmp

memory/740-22-0x0000000000400000-0x000000000042E000-memory.dmp

memory/1792-40-0x0000000000400000-0x000000000045C000-memory.dmp

memory/740-20-0x0000000000400000-0x000000000042E000-memory.dmp

memory/1032-13-0x0000000000400000-0x000000000042E000-memory.dmp

memory/1896-12-0x0000000000580000-0x0000000000581000-memory.dmp

C:\Windows\System32\config\systemprofile\Favorites\desktop.ini

MD5 881dfac93652edb0a8228029ba92d0f5
SHA1 5b317253a63fecb167bf07befa05c5ed09c4ccea
SHA256 a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464
SHA512 592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat

MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0ff131b0b22303b6d81dbc5abf896e33
SHA1 ccabc586396c5fc009d5fa9fdfea8cff8e1da40d
SHA256 bc2f4003e744eb008c887d4ac554da198d5a3c19a127e77c968927ae9fb5cdfd
SHA512 942d1dfbc1cb915b7838e159c54aed12f1192fbcb7008c125385dc83cd1eb80f97982ad8b617e4b209e3f693dab83c9a161f2bfed59d1dc6458cf69160261513

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 977cf8fdefd0c0df29b95c47e1aa855f
SHA1 8c12667e5c929746a453ac23d27dea541432abf4
SHA256 93b9708fc39976b32a37e04e5191b2f6c8db1e71579cbf0cc47440a250492ab9
SHA512 0e39f017931fd2a05c2285bfbd423f727c76664aba70f78ea5bc3c790287db7a795876645d60ed008bc6872dbd663ca1ac3c98f93201bfe4d08f38391f94a608

\??\pipe\LOCAL\crashpad_4988_GGVUINNMPLDYEHIE

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\5db4c9cf-d6ae-4f7a-94af-0e9ad0ac15de.tmp

MD5 e5e3377341056643b0494b6842c0b544
SHA1 d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256 e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA512 83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 7a6ff8bebb40bde993c600779f67b9c7
SHA1 679571e9e6888fb5eda8281df765146bcde75b9e
SHA256 d77b66cb70e959c8cb3a067fd1443ba7d86493cd2441f62d433b2879ac49e0d0
SHA512 7d16cef9166cb0436e79f74e49c040f3704521a525869bcfe35288ca6460d9049e601d94223ebea08327b156356ba28fa02d62c687e33e4ff93d8df659a70831

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe574d26.TMP

MD5 575ec50ba6013fea3657d3f70568e7a7
SHA1 88f34dd796968d5f8e7d07bbaa07fb9c0528b590
SHA256 f96b40181f976b286b1791c045755384845a2925e90ddd4d13250615fc42f750
SHA512 f6c14718793681e0778b818be7a865cda3533755930d834a887ca981c3f5ddafa6aa405f51c3a4f8baf76ceeaa42f55348db7322844d4eaf012316f53ef82fd9

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 edeba22b63643fd6a5bca49cae8e3ce4
SHA1 92c0544d12675c0e080326351999cc8f25e6d1ce
SHA256 cf51bd63f71ecbea481e14b33e3370d2f362256cfbeec190c5fe23af5559332d
SHA512 848662dd1d597628dffaac0b13fb79a0e21e9355b095364b3fbd4c5320c3ff64db1536f27b0a404b37d8512dce051cd62acd69b82be2acb9b378fa7b7bf08b97

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\1b5643ec-d9b2-4091-9594-5dc31dcf7498.tmp

MD5 db13b5cb6825fc783f7bb7406f530fdc
SHA1 6f2867b988852ac7aadc47e2bf011543ee073429
SHA256 7db36dfaf2ab66e37c85823f47d0b5f534f18273614176dad22a245259e2ede8
SHA512 b74962538eb966000a0d7f7573338b0344c420a2c6084eff3f81ae1c6fffd06c7ab63cd0cd32c84935c4c84a9020bd8ce76967d839057860d35b1cf719e54a69

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 d148ff4e7f45da23326cfa90de3f2107
SHA1 b585e21b672c7fdbf446ecabd8985e279598068e
SHA256 c966630ae99ebb891785ab2595683d74f00af78c86f4863794b18fa76069fd06
SHA512 9766420f44b421e74b4f98368c91cadda9bad53be87ff5e29cbc4f4eee1a07cc05cad673397266a0aa2aa55cf35f0b454f40db95d568263c543f99332456c291

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State~RFe578608.TMP

MD5 e7667cab2d3ee22b314db7c199a90fb2
SHA1 49a959f8b0d5616b0d00c4238e035822af2fb2bc
SHA256 8a53b2e7fdcc370ba1f1820268c4cbb5771898e18313a7a7385f0c542a9a076f
SHA512 78952c2dc7e60a9ea74efb0050eebebfe31a7e084de0589998ff4aaf41001772e62850cbf34853f517bfddbe59f9a08f27d9663771b36892c246c9fbd309824a

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 24d66ba1c74b0d959a30242a81745f3c
SHA1 e635895f4bbfce9e03eb5719aa7f9f2734217f04
SHA256 aaffc5e7b31bbfd8a7977c8e504ba722ce4443ff008b10d0901f2eb872c5c7a4
SHA512 244964171f51f136bda5011b48e449e4e7844236febf4e29fe5fa26ebfbab54f1ab4013272fc06dbcca72d56610843c2baf659a15410793d03f96184daf106d7

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\a9bbe3cf-5b2d-4a34-a8ef-2308bcafcc13.tmp

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network Persistent State

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

memory/3816-388-0x0000000000400000-0x000000000045C000-memory.dmp