Malware Analysis Report

2025-01-19 04:53

Sample ID 240617-3qe5paygld
Target ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118
SHA256 d90dc3f22cc7bd92f22bafa9d77b0e373849386eae57606b42239f915357084a
Tags
collection persistence spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

d90dc3f22cc7bd92f22bafa9d77b0e373849386eae57606b42239f915357084a

Threat Level: Shows suspicious behavior

The file ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

collection persistence spyware stealer

Reads user/profile data of web browsers

Reads data files stored by FTP clients

Reads WinSCP keys stored on the system

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of local email clients

Looks up external IP address via web service

Adds Run key to start application

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

outlook_office_path

Suspicious use of SendNotifyMessage

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

outlook_win_path

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-17 23:42

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-17 23:42

Reported

2024-06-17 23:45

Platform

win7-20231129-en

Max time kernel

149s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Travel = "C:\\Users\\Admin\\AppData\\Roaming\\Terry\\TPO.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1276 set thread context of 2844 N/A C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\G33.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1276 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
PID 1276 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
PID 1276 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
PID 1276 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
PID 1276 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
PID 1276 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
PID 1276 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
PID 1276 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
PID 1276 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
PID 2844 wrote to memory of 2852 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 2844 wrote to memory of 2852 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 2844 wrote to memory of 2852 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 2844 wrote to memory of 2852 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 2844 wrote to memory of 2616 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe C:\Users\Admin\AppData\Local\Temp\G33.exe
PID 2844 wrote to memory of 2616 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe C:\Users\Admin\AppData\Local\Temp\G33.exe
PID 2844 wrote to memory of 2616 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe C:\Users\Admin\AppData\Local\Temp\G33.exe
PID 2844 wrote to memory of 2616 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe C:\Users\Admin\AppData\Local\Temp\G33.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sar_Senapati_SGSF_Ltd._11.09.pdf"

C:\Users\Admin\AppData\Local\Temp\G33.exe

"C:\Users\Admin\AppData\Local\Temp\G33.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 checkip.dyndns.org udp
US 158.101.44.242:80 checkip.dyndns.org tcp

Files

memory/1276-0-0x0000000000230000-0x0000000000231000-memory.dmp

memory/1276-1-0x0000000000400000-0x0000000000494000-memory.dmp

memory/1276-2-0x0000000002C90000-0x0000000002D85000-memory.dmp

memory/1276-3-0x0000000003370000-0x0000000003465000-memory.dmp

memory/2844-7-0x0000000000400000-0x0000000000456000-memory.dmp

memory/2844-6-0x0000000000400000-0x0000000000456000-memory.dmp

memory/1276-11-0x0000000003370000-0x0000000003465000-memory.dmp

memory/1276-10-0x0000000002C90000-0x0000000002D85000-memory.dmp

memory/1276-5-0x0000000000400000-0x0000000000494000-memory.dmp

memory/2844-9-0x0000000000400000-0x0000000000456000-memory.dmp

memory/2844-12-0x00000000740A2000-0x00000000740A4000-memory.dmp

\Users\Admin\AppData\Local\Temp\G33.exe

MD5 f683769b947501b5a98376619d5938bb
SHA1 6a38e4acd9ade0d85697d10683ec84fa0daed11c
SHA256 c2cae82e01d954e3a50feaebcd3f75de7416a851ea855d6f0e8aaac84a507ca3
SHA512 dbd7a26139c5ef6a409fb247b08eb54c62328edace9a047aac3ca75b8e552572428dbda4efc7836398fa4d2d9e68075e10e2436efcf1f9fc138d69ac440bd556

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sar_Senapati_SGSF_Ltd._11.09.pdf

MD5 388ef153194af2f17a70a82c0f65ce8f
SHA1 00e6684fecd83d78d0d1123e591ed10abe2c867c
SHA256 615d36ea54f42ee5ede68d7dbc5a07fa112b6b6a57bb2d75a70181c21c15c8cc
SHA512 b6423b046ad56a354bf34ba2f6adb55a6eeaaf51883007b41eb0717c161125ab8dd591a07a0975db4357db63efa05035d24ab01183da276c1d41c6d18954b236

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 4ec6f2fe6a716025309134eb7f1e0f56
SHA1 24d7e5efc4cdabb2b1c252064111fa1a10ebfa38
SHA256 48029f409bdcf599e84de4fd25bc7ace0f7fbd2929ff4ef10c49cf0091511dc6
SHA512 86d5923dfdead7c3347935c7c995d8f067cafad3831e44386ca3a66ed9183a56cebd06a9837cf99eb1337fb0b24f316ddaeb4a827b3450ed45f8a4b5964bd326

memory/2844-40-0x00000000740A2000-0x00000000740A4000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 23:42

Reported

2024-06-17 23:45

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Travel = "C:\\Users\\Admin\\AppData\\Roaming\\Terry\\TPO.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 880 set thread context of 2436 N/A C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NP1.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 880 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
PID 880 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
PID 880 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
PID 880 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
PID 880 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
PID 880 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
PID 880 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
PID 880 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
PID 2436 wrote to memory of 4432 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2436 wrote to memory of 4432 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4284 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4284 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2436 wrote to memory of 4620 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe C:\Users\Admin\AppData\Local\Temp\NP1.exe
PID 2436 wrote to memory of 4620 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe C:\Users\Admin\AppData\Local\Temp\NP1.exe
PID 2436 wrote to memory of 4620 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe C:\Users\Admin\AppData\Local\Temp\NP1.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 3304 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 3304 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 4720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sar_Senapati_SGSF_Ltd._11.09.pdf

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffb7be46f8,0x7fffb7be4708,0x7fffb7be4718

C:\Users\Admin\AppData\Local\Temp\NP1.exe

"C:\Users\Admin\AppData\Local\Temp\NP1.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5124 /prefetch:6

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3036 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
DE 193.122.6.168:80 checkip.dyndns.org tcp
US 8.8.8.8:53 168.6.122.193.in-addr.arpa udp
US 8.8.8.8:53 72.242.123.52.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp

Files

memory/880-0-0x0000000002110000-0x0000000002111000-memory.dmp

memory/880-1-0x0000000000400000-0x0000000000494000-memory.dmp

memory/880-2-0x0000000002420000-0x0000000002515000-memory.dmp

memory/880-3-0x0000000002BB0000-0x0000000002CA5000-memory.dmp

memory/2436-4-0x0000000000400000-0x0000000000456000-memory.dmp

memory/880-5-0x0000000000400000-0x0000000000494000-memory.dmp

memory/880-7-0x0000000002BB0000-0x0000000002CA5000-memory.dmp

memory/880-6-0x0000000002420000-0x0000000002515000-memory.dmp

memory/2436-8-0x00000000742B2000-0x00000000742B3000-memory.dmp

memory/2436-9-0x00000000742B0000-0x0000000074861000-memory.dmp

memory/2436-10-0x00000000742B0000-0x0000000074861000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\NP1.exe

MD5 f683769b947501b5a98376619d5938bb
SHA1 6a38e4acd9ade0d85697d10683ec84fa0daed11c
SHA256 c2cae82e01d954e3a50feaebcd3f75de7416a851ea855d6f0e8aaac84a507ca3
SHA512 dbd7a26139c5ef6a409fb247b08eb54c62328edace9a047aac3ca75b8e552572428dbda4efc7836398fa4d2d9e68075e10e2436efcf1f9fc138d69ac440bd556

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 b704c9ca0493bd4548ac9c69dc4a4f27
SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32

memory/4620-31-0x00000000742B0000-0x0000000074861000-memory.dmp

memory/4620-32-0x00000000742B0000-0x0000000074861000-memory.dmp

\??\pipe\LOCAL\crashpad_4432_WKDYQIFUIMCALMUD

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
SHA1 86174e670c44767c08a39cc2a53c09c318326201
SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sar_Senapati_SGSF_Ltd._11.09.pdf

MD5 388ef153194af2f17a70a82c0f65ce8f
SHA1 00e6684fecd83d78d0d1123e591ed10abe2c867c
SHA256 615d36ea54f42ee5ede68d7dbc5a07fa112b6b6a57bb2d75a70181c21c15c8cc
SHA512 b6423b046ad56a354bf34ba2f6adb55a6eeaaf51883007b41eb0717c161125ab8dd591a07a0975db4357db63efa05035d24ab01183da276c1d41c6d18954b236

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 31512b8db8e800ec7fdf768fe7031a06
SHA1 3c72163a378057375bdf5c6d9f16b585a9c24cd1
SHA256 a4c4158e29faa636aec3985f8ea9d6578f8ba5fc0ba48e02e7df9789ee0f564c
SHA512 46b96d3822f192e3b4be56d5530590e43792f4d764073fd96c112737ab5624b22946f05e1d7a41d8821acf3115d83cf535ef911218b11a23b0b0eab0aea6b6b0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 08b538678864e6a524cf8d12f0ce6d27
SHA1 f114071ae6556e7199b5e6b2786d540b5e64805e
SHA256 b74e4f00ad524fac45ec09568352032a853c33d58379885fe1c60da1f29c5c5a
SHA512 745857690e4b95f29bcd1c115b88094eef6e5c723f67c3bb05e2323f605e5e3fc28bea79903000f00077b9cde926e71fe21068d34052bfeaaf3498a2102ec59d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 f4cd8b804b681ac2b14caa16350bf3df
SHA1 9f684667ab79765eb0f156f35b2287b14a0cc054
SHA256 ac605a5d5f08bfe55d1b7866b53ad16fc85771c1f2cb397159f3aa0c4e269721
SHA512 8fd820e1829b08f2f68fbafe0e0c18cd27e54a3479ad633735f17b9c726f86029cfe392c7023a6d83caf122ed194f425a7cee1b70481fcc686b82a85c997dbc8

memory/2436-80-0x00000000742B2000-0x00000000742B3000-memory.dmp

memory/2436-81-0x00000000742B0000-0x0000000074861000-memory.dmp

memory/4620-82-0x00000000742B0000-0x0000000074861000-memory.dmp