Malware Analysis Report

2025-01-02 13:36

Sample ID 241205-a91lhswkal
Target c521f79249320c77b5b20007f871fbb1_JaffaCakes118
SHA256 2cd607fb44480b61c90e5107a3131231936c99a7b766dbed4df4c6fed325ae0f
Tags
hawkeye collection discovery keylogger persistence spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2cd607fb44480b61c90e5107a3131231936c99a7b766dbed4df4c6fed325ae0f

Threat Level: Known bad

The file c521f79249320c77b5b20007f871fbb1_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

hawkeye collection discovery keylogger persistence spyware stealer trojan upx

Hawkeye family

HawkEye

Detected Nirsoft tools

NirSoft WebBrowserPassView

NirSoft MailPassView

Loads dropped DLL

Executes dropped EXE

Uses the VBS compiler for execution

Reads user/profile data of web browsers

Checks computer location settings

Looks up external IP address via web service

Accesses Microsoft Outlook accounts

Adds Run key to start application

UPX packed file

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Checks processor information in registry

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-05 00:55

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-05 00:55

Reported

2024-12-05 00:58

Platform

win7-20240903-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

Hawkeye family

hawkeye

Detected Nirsoft tools

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2516 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2516 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2516 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2516 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2516 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2516 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2516 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2272 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2272 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2272 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2272 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2272 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2272 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2272 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2272 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2272 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2272 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2272 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2272 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2272 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2272 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2272 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2272 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 1692 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 1692 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 1692 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 1692 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 1692 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 1692 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 1692 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 1692 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1692 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\BFile_1.pdf"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

Network

Country Destination Domain Proto
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.19.222.79:80 whatismyipaddress.com tcp
US 104.19.222.79:443 whatismyipaddress.com tcp
US 104.19.222.79:443 whatismyipaddress.com tcp
US 8.8.8.8:53 webmail.congtydirect.com udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe

MD5 bc9932d562808f046db8cf2d225b317e
SHA1 50827e282cb74b846b8ef79ccd3f5887e3a941f2
SHA256 49a50d91166a62cb0c1454d015af0b5b98ea86702c9e88c21f6e5775517571b7
SHA512 d46153b9d0260a076fd6247de14325b2f76d7537139677af927427fab23852258634b525a1e3e31e19456a04a5c58527ac351f44b475c2eb984294b30b0efa22

memory/2272-13-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2516-12-0x0000000000360000-0x00000000003BC000-memory.dmp

memory/2516-11-0x0000000000360000-0x00000000003BC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.ex_

MD5 aa9da8f4f5e434d8449c17efccebef5e
SHA1 99487070bb0da9e0c2df138b111e9bebc2a271f2
SHA256 16b6bdc384d7b4821d541eb40f1be8c3ca2b027b9a329e77eb4c13800b3e8ec2
SHA512 768fb0d93c91ad868f7b2cfc0fc67ce2e20293e40ec1e4216bb805232a2f02cdfd3ec225c29c40bed6c4f505aa35b788f5291661b99d2773c24d395c825ef0cb

memory/2272-23-0x0000000000280000-0x0000000000285000-memory.dmp

memory/2272-26-0x0000000000310000-0x000000000036C000-memory.dmp

memory/1692-27-0x0000000000300000-0x0000000000400000-memory.dmp

memory/1692-30-0x0000000000400000-0x0000000004B18000-memory.dmp

memory/1692-36-0x0000000000400000-0x0000000004B18000-memory.dmp

memory/1692-40-0x0000000000400000-0x0000000004B18000-memory.dmp

memory/1692-34-0x0000000000400000-0x0000000004B18000-memory.dmp

memory/1692-37-0x0000000000400000-0x0000000004B18000-memory.dmp

memory/1692-41-0x0000000000400000-0x0000000004B18000-memory.dmp

memory/1692-43-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe

MD5 42ccd69a3be9618d329de0ea0fde3a81
SHA1 47e9897f303496eb9cd5883f9cdb283b6eee65d3
SHA256 14137fcc8697e967b251fd0fafbdf79af8db4c1a67f2eafe53756e3ad80a9bef
SHA512 33d95b20ce606441c89dbc575c8e884196a19db056ffd9d54a5e0c57f3928b0d064b6270e4abf033046606e0456156faba3f3a8e6a353e924a7461e61e46bfae

memory/1692-50-0x0000000000400000-0x0000000004B18000-memory.dmp

memory/1692-48-0x0000000000400000-0x0000000004B18000-memory.dmp

memory/1692-31-0x0000000000400000-0x0000000004B18000-memory.dmp

memory/1692-51-0x0000000000400000-0x0000000004B18000-memory.dmp

memory/2272-54-0x0000000000400000-0x000000000045C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BFile_1.pdf

MD5 a044a4eaea50ac33f65fd614f4b78509
SHA1 f4c1d9a86ee7769492293508f650f67dc3c523f7
SHA256 8f9c44049129703f3d6d3beeff6ac8d576df276a56e8f7f85c86beda912ed8c4
SHA512 9fbeae185958d0c7868bc21fd08220cc8e1f6aaa6cea14ffbb257a93355ba043e294be25ae40c8f80d75563bdd1f9cec3f29afa944b3cac11664ec4b066822d3

memory/2936-70-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2936-71-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2936-73-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2936-76-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2024-80-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2024-78-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2024-77-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2024-86-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holderwb.txt

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-05 00:55

Reported

2024-12-05 00:58

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

Hawkeye family

hawkeye

Detected Nirsoft tools

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3016 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 3016 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 3016 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2456 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2456 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2456 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2456 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2456 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2456 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2456 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2456 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2456 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2456 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 2456 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
PID 4028 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 4028 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 4028 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 4028 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4028 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4028 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4028 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4028 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4028 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4028 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4028 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4028 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3032 wrote to memory of 616 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3032 wrote to memory of 616 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3032 wrote to memory of 616 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 616 wrote to memory of 1092 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\BFile_1.pdf"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D234FD33C677FCD7B740198EEC136EAE --mojo-platform-channel-handle=1768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2335F9CFDE3813C84293A9A23DB4A950 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2335F9CFDE3813C84293A9A23DB4A950 --renderer-client-id=2 --mojo-platform-channel-handle=1804 --allow-no-sandbox-job /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A0E5B60D2F50853EC27CC95CCEE2F20A --mojo-platform-channel-handle=2368 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AD570094EE0708ECB07C8E8F1D20C688 --mojo-platform-channel-handle=1972 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2843E2ACDAD26B644D4413047606F879 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2843E2ACDAD26B644D4413047606F879 --renderer-client-id=6 --mojo-platform-channel-handle=1960 --allow-no-sandbox-job /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C3B435898B86BB65BBB56B48F1724BBF --mojo-platform-channel-handle=2728 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.19.223.79:80 whatismyipaddress.com tcp
US 104.19.223.79:443 whatismyipaddress.com tcp
US 8.8.8.8:53 webmail.congtydirect.com udp
US 8.8.8.8:53 79.223.19.104.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 204.20.192.23.in-addr.arpa udp
US 8.8.8.8:53 98.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 webmail.congtydirect.com udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe

MD5 bc9932d562808f046db8cf2d225b317e
SHA1 50827e282cb74b846b8ef79ccd3f5887e3a941f2
SHA256 49a50d91166a62cb0c1454d015af0b5b98ea86702c9e88c21f6e5775517571b7
SHA512 d46153b9d0260a076fd6247de14325b2f76d7537139677af927427fab23852258634b525a1e3e31e19456a04a5c58527ac351f44b475c2eb984294b30b0efa22

memory/2456-6-0x0000000000400000-0x000000000045C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.ex_

MD5 aa9da8f4f5e434d8449c17efccebef5e
SHA1 99487070bb0da9e0c2df138b111e9bebc2a271f2
SHA256 16b6bdc384d7b4821d541eb40f1be8c3ca2b027b9a329e77eb4c13800b3e8ec2
SHA512 768fb0d93c91ad868f7b2cfc0fc67ce2e20293e40ec1e4216bb805232a2f02cdfd3ec225c29c40bed6c4f505aa35b788f5291661b99d2773c24d395c825ef0cb

memory/2456-15-0x00000000022B0000-0x00000000022B5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe

MD5 7bae06cbe364bb42b8c34fcfb90e3ebd
SHA1 79129af7efa46244da0676607242f0a6b7e12e78
SHA256 6ceaebd55b4a542ef64be1d6971fcfe802e67e2027366c52faacc8a8d325ec7a
SHA512 c599b72500a5c17cd5c4a81fcf220a95925aa0e5ad72aa92dd1a469fe6e3c23590c548a0be7ec2c4dbd737511a0a79c1c46436867cf7f0c4df21f8dcea9686cf

memory/4028-21-0x0000000073E72000-0x0000000073E73000-memory.dmp

memory/4028-22-0x0000000073E70000-0x0000000074421000-memory.dmp

memory/4028-23-0x0000000073E70000-0x0000000074421000-memory.dmp

memory/2456-25-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4028-17-0x0000000000400000-0x0000000004B18000-memory.dmp

memory/4028-26-0x0000000073E70000-0x0000000074421000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BFile_1.pdf

MD5 a044a4eaea50ac33f65fd614f4b78509
SHA1 f4c1d9a86ee7769492293508f650f67dc3c523f7
SHA256 8f9c44049129703f3d6d3beeff6ac8d576df276a56e8f7f85c86beda912ed8c4
SHA512 9fbeae185958d0c7868bc21fd08220cc8e1f6aaa6cea14ffbb257a93355ba043e294be25ae40c8f80d75563bdd1f9cec3f29afa944b3cac11664ec4b066822d3

memory/3008-37-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3008-35-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3008-34-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3008-39-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4028-40-0x0000000073E72000-0x0000000073E73000-memory.dmp

memory/4028-41-0x0000000073E70000-0x0000000074421000-memory.dmp

memory/4028-69-0x0000000073E70000-0x0000000074421000-memory.dmp

memory/2968-71-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2968-74-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2968-72-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holderwb.txt

MD5 f94dc819ca773f1e3cb27abbc9e7fa27
SHA1 9a7700efadc5ea09ab288544ef1e3cd876255086
SHA256 a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA512 72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

memory/2968-80-0x0000000000460000-0x0000000000529000-memory.dmp

memory/2968-81-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 c9a7e5fc6d1ed825239d6c335a23401f
SHA1 78616cf7dee43efc38ad4c824bfe3ff83f3cc749
SHA256 3121a2dc33fd277b0c7a17a95fa54665248f039eaa181aad656168970d969e57
SHA512 8cfecf041691734108d31022a4177703d7261535ae373c64eb7624dfba3f25d3fe25b6dae67c9b932ad3627576dca6cd12522189dc8aee687d27089e56acf63b