Malware Analysis Report

2025-04-03 10:13

Sample ID 250214-b2h7yaykgp
Target JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49
SHA256 41e8e0e2c8852b21ececb4640336fef5e0c149462efac9ab63b2c16748c3eedb
Tags
blackshades defense_evasion discovery persistence rat upx adware privilege_escalation stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

41e8e0e2c8852b21ececb4640336fef5e0c149462efac9ab63b2c16748c3eedb

Threat Level: Known bad

The file JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49 was found to be: Known bad.

Malicious Activity Summary

blackshades defense_evasion discovery persistence rat upx adware privilege_escalation stealer

Blackshades family

Blackshades payload

Modifies firewall policy service

Blackshades

Boot or Logon Autostart Execution: Active Setup

Downloads MZ/PE file

Adds policy Run key to start application

Executes dropped EXE

Event Triggered Execution: Component Object Model Hijacking

Checks installed software on the system

Adds Run key to start application

Installs/modifies Browser Helper Object

Suspicious use of SetThreadContext

UPX packed file

Drops file in System32 directory

Drops file in Program Files directory

System Network Configuration Discovery: Internet Connection Discovery

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

Modifies system certificate store

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

System policy modification

Suspicious use of SetWindowsHookEx

Modifies registry key

Modifies data under HKEY_USERS

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-14 01:38

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-14 01:38

Reported

2025-02-14 01:40

Platform

win7-20241010-en

Max time kernel

148s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Adobe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Active Setup\Installed Components\java\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\java C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\java\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\java C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Modifies system certificate store

defense_evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1996 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe
PID 1996 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe
PID 1996 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe
PID 1996 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe
PID 1996 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe
PID 1996 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe
PID 1996 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe
PID 1996 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe
PID 2744 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 2812 wrote to memory of 3052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2812 wrote to memory of 3052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2812 wrote to memory of 3052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2812 wrote to memory of 3052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2672 wrote to memory of 2800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2672 wrote to memory of 2800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2672 wrote to memory of 2800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2672 wrote to memory of 2800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2788 wrote to memory of 2132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2788 wrote to memory of 2132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2788 wrote to memory of 2132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2788 wrote to memory of 2132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2880 wrote to memory of 2836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2880 wrote to memory of 2836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2880 wrote to memory of 2836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2880 wrote to memory of 2836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe"

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 0udp.no-ip.biz udp
US 8.8.8.8:53 dl.dropbox.com udp
GB 162.125.64.15:80 dl.dropbox.com tcp
GB 162.125.64.15:443 dl.dropbox.com tcp
US 8.8.8.8:53 10udp.no-ip.biz udp
PS 94.73.26.136:8030 10udp.no-ip.biz tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 2.22.5.218:80 www.microsoft.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 104.77.160.74:80 crl.microsoft.com tcp
US 8.8.8.8:53 20udp.no-ip.biz udp
PS 94.73.26.136:8030 20udp.no-ip.biz tcp
US 8.8.8.8:53 30udp.no-ip.biz udp
US 78.159.143.172:8030 30udp.no-ip.biz tcp
US 8.8.8.8:53 40udp.no-ip.biz udp
US 8.8.8.8:53 50udp.no-ip.biz udp
US 8.8.8.8:53 60udp.no-ip.biz udp
US 8.8.8.8:53 70udp.no-ip.biz udp
US 8.8.8.8:53 80udp.no-ip.biz udp

Files

memory/2744-2-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2744-10-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-6-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-4-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-12-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-13-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-15-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-21-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-37-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-38-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-40-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-41-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-43-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-44-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-46-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-47-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-48-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-50-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-51-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-52-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-53-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-55-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-56-0x0000000000400000-0x0000000000473000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-14 01:38

Reported

2025-02-14 01:40

Platform

win10v2004-20250211-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Adobe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2656314083-4170277356-267438488-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\java\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE} C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\ = "Microsoft Edge" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\StubPath = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\Installer\\setup.exe\" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Localized Name = "Microsoft Edge" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\IsInstalled = "1" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\java C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\java\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Version = "43,0,0,0" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2656314083-4170277356-267438488-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\java C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A

Downloads MZ/PE file

Description Indicator Process Target
N/A N/A N/A N/A

Event Triggered Execution: Component Object Model Hijacking

persistence privilege_escalation

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2656314083-4170277356-267438488-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A

Checks installed software on the system

discovery

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\libEGL.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\cy.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files\MsEdgeCrashpad\settings.dat C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\identity_proxy\dev.identity_helper.exe.manifest C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\fi.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\v8_context_snapshot.bin C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\fr-CA.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\gd.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Installer\msedge_7z.data C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\identity_proxy\dev.identity_helper.exe.manifest C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\ro.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\msedge_100_percent.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\delegatedWebFeatures.sccd C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files\MsEdgeCrashpad\throttle_store.dat C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\edge_game_assist\VERSION C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\MEIPreload\preloaded_data.pb C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\pa.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\as.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\it.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files\MsEdgeCrashpad\settings.dat C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\dxcompiler.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\km.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\wns_push_client.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\ta.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\hu.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\sr-Latn-RS.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\sr.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\notification_helper.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\msvcp140_codecvt_ids.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\WidevineCdm\manifest.json C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\dual_engine_adapter_x64.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\msedge_pwa_launcher.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\identity_proxy\win10\identity_helper.Sparse.Internal.msix C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\resources.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\ar.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\icudtl.dat C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\ka.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\ug.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\AdSelectionAttestationsPreloaded\ad-selection-attestations.dat C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\PdfPreview\PdfPreviewHandler.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\vulkan-1.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\msedge_proxy.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\ga.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\identity_proxy\canary.identity_helper.exe.manifest C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\identity_proxy\win11\identity_helper.Sparse.Internal.msix C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\mt.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\MEIPreload\preloaded_data.pb C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\nn.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\sl.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\tt.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\db0e091e-4ce1-4b07-880d-cc829ace5dd0.tmp C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\1784_13383970839473096_1784.pma C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\ja.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Trust Protection Lists\manifest.json C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Trust Protection Lists\Mu\Other C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\bg.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\msedge_200_percent.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\onnxruntime.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\id.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\ne.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\es.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\ms.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Trust Protection Lists\Sigma\Analytics C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\msedge.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\EnterpriseMode C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2656314083-4170277356-267438488-1000\Software\Microsoft\Internet Explorer\GPU C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2656314083-4170277356-267438488-1000\SOFTWARE\Microsoft\Internet Explorer\GPU C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29} C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\BHO" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\BHO" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations\C:\Program Files (x86)\Microsoft\Edge\Application = "1" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\EnterpriseMode\MSEdgePath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29} C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\InstallerPinned = "0" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO\ = "IEToEdgeBHO Class" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO\CurVer\ = "ie_to_edge_bho.IEToEdgeBHO.1" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}\TypeLib C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B} C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}\TypeLib\Version = "1.0" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO.1\CLSID\ C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSEdgePDF\shell\runas\command C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2656314083-4170277356-267438488-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftofficehub_8wekyb3d8bbwe\Internet Explorer\DOMStorage\office.com\ = "0" C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\.html\OpenWithProgids C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\.shtml\OpenWithProgids C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\shell\open\command C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSEdgeHTM C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\ = "Microsoft Edge MHT Document" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0\0\win64\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\elevation_service.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSEdgePDF C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSEdgePDF\shell\runas C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\EnablePreviewHandler = "1" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSEdgeMHT\shell\runas\command C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mhtml\OpenWithProgIds\MSEdgeMHT C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Programmable\ C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO\CurVer\ C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{B54934CD-71A6-4698-BDC2-AFEA5B86504C}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSEdgePDF\DefaultIcon C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSEdgePDF\shell C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithProgIds\MSEdgeHTM C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithProgIds\MSEdgeMHT C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2656314083-4170277356-267438488-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftofficehub_8wekyb3d8bbwe\Internet Settings\Cache\Content C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\AppID = "{6d2b5079-2f0b-48dd-ab7f-97cec514d30b}" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\shell\open\command\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" \"%1\"" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2656314083-4170277356-267438488-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftofficehub_8wekyb3d8bbwe\Internet Settings\Cache\Cookies C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}\ C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSEdgePDF\shell\open\command C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.html\OpenWithProgIds\MSEdgeHTM C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B54934CD-71A6-4698-BDC2-AFEA5B86504C}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\EBWebView\\x64\\EmbeddedBrowserWebView.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell\runas\command\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --do-not-de-elevate --single-argument %1" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSEdgePDF\Application C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E} C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ProgID\ C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/pdf\Extension = ".pdf" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\.svg\OpenWithProgids C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ie_to_edge_bho.dll\ C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ie_to_edge_bho.dll\AppID = "{31575964-95F7-414B-85E4-0E9A93699E13}" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories\ C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2656314083-4170277356-267438488-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftofficehub_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\system32\wwahost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\shell\open\command C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\.htm C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSEdgeMHT\shell\runas C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2656314083-4170277356-267438488-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftofficehub_8wekyb3d8bbwe\Internet Explorer\EdpDomStorage\office.com C:\Windows\system32\wwahost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\PdfPreview\\PdfPreviewHandler.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSEdgeHTM\shell C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xht\OpenWithProgIds\MSEdgeHTM C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2656314083-4170277356-267438488-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftofficehub_8wekyb3d8bbwe\Internet Settings\Cache C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2656314083-4170277356-267438488-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftofficehub_8wekyb3d8bbwe\Internet Settings\Cache\History C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\AppID\{1FCBE96C-1697-43AF-9140-2897C7C69767} C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1FCBE96C-1697-43AF-9140-2897C7C69767}\LocalService = "MicrosoftEdgeElevationService" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{31575964-95F7-414B-85E4-0E9A93699E13}\ = "ie_to_edge_bho" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2656314083-4170277356-267438488-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftofficehub_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheVersion = "1" C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\.webp C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe N/A
Token: 33 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wwahost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wwahost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2144 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe
PID 2144 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe
PID 2144 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe
PID 2144 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe
PID 2144 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe
PID 2144 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe
PID 2144 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe
PID 2144 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe
PID 3548 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 3548 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 3548 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 3548 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 3548 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 3548 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 3548 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 3548 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 3548 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 3548 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 3548 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 3548 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe C:\Windows\SysWOW64\cmd.exe
PID 4948 wrote to memory of 2032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4948 wrote to memory of 2032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4948 wrote to memory of 2032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5024 wrote to memory of 4504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5024 wrote to memory of 4504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5024 wrote to memory of 4504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5008 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5008 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5008 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3704 wrote to memory of 3444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3704 wrote to memory of 3444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3704 wrote to memory of 3444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2608 wrote to memory of 3272 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\MicrosoftEdge_X64_133.0.3065.59.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe
PID 2608 wrote to memory of 3272 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\MicrosoftEdge_X64_133.0.3065.59.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe
PID 3272 wrote to memory of 4236 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe
PID 3272 wrote to memory of 4236 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe
PID 3272 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe
PID 3272 wrote to memory of 216 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe
PID 216 wrote to memory of 184 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe
PID 216 wrote to memory of 184 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe
PID 3272 wrote to memory of 4888 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
PID 3272 wrote to memory of 4888 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
PID 3272 wrote to memory of 2168 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
PID 3272 wrote to memory of 2168 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
PID 3272 wrote to memory of 1784 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
PID 3272 wrote to memory of 1784 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
PID 2168 wrote to memory of 1056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
PID 2168 wrote to memory of 1056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
PID 4888 wrote to memory of 4488 N/A C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
PID 4888 wrote to memory of 4488 N/A C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
PID 1784 wrote to memory of 1344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
PID 1784 wrote to memory of 1344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe

System policy modification

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\ C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} = "1" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe"

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f29d5c214d1622dd9e6c65996c977f49.exe:*:Enabled:Windows Messanger" /f

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REY3OTI5M0YtQ0JBQi00RUNFLTgzQ0EtRDlGNkRGQTY1QkQ4fSIgdXNlcmlkPSJ7RDVEQTY4RDQtNUQ1NS00MjNBLUFBNUQtODIzQ0E1OTBEODJEfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MEZDMjRDQUYtNEVCQi00Nzc4LUE5NDMtOEEzRDU5RDYwNTY4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODM0MTAiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NTUzNjg2NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTM3NTg0MjUwIi8-PC9hcHA-PC9yZXF1ZXN0Pg

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\MicrosoftEdge_X64_133.0.3065.59.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7c0c26a68,0x7ff7c0c26a74,0x7ff7c0c26a80

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7c0c26a68,0x7ff7c0c26a74,0x7ff7c0c26a80

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff78e5a6a68,0x7ff78e5a6a74,0x7ff78e5a6a80

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff78e5a6a68,0x7ff78e5a6a74,0x7ff78e5a6a80

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff78e5a6a68,0x7ff78e5a6a74,0x7ff78e5a6a80

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness

C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe

"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch

C:\Windows\system32\wwahost.exe

"C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa

Network

Country Destination Domain Proto
US 8.8.8.8:53 dl.dropbox.com udp
US 8.8.8.8:53 0udp.no-ip.biz udp
GB 162.125.64.15:80 dl.dropbox.com tcp
GB 162.125.64.15:443 dl.dropbox.com tcp
US 8.8.8.8:53 0udp.no-ip.biz udp
US 8.8.8.8:53 10udp.no-ip.biz udp
PS 94.73.26.136:8030 10udp.no-ip.biz tcp
US 8.8.8.8:53 20udp.no-ip.biz udp
PS 94.73.26.136:8030 20udp.no-ip.biz tcp
US 8.8.8.8:53 msedge.api.cdp.microsoft.com udp
US 4.151.228.221:443 msedge.api.cdp.microsoft.com tcp
US 8.8.8.8:53 30udp.no-ip.biz udp
US 78.159.143.172:8030 30udp.no-ip.biz tcp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
GB 104.91.71.142:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 40udp.no-ip.biz udp
US 8.8.8.8:53 50udp.no-ip.biz udp
US 8.8.8.8:53 60udp.no-ip.biz udp
US 150.171.27.10:443 tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 70udp.no-ip.biz udp
US 8.8.8.8:53 80udp.no-ip.biz udp
US 8.8.8.8:53 www.office.com udp
US 13.107.6.156:443 www.office.com tcp
US 8.8.8.8:53 nav.smartscreen.microsoft.com udp
GB 51.140.242.104:443 nav.smartscreen.microsoft.com tcp
US 8.8.8.8:53 data-edge.smartscreen.microsoft.com udp
GB 172.165.61.93:443 data-edge.smartscreen.microsoft.com tcp
GB 172.165.61.93:443 data-edge.smartscreen.microsoft.com tcp
GB 172.165.61.93:443 data-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 res.cdn.office.net udp
GB 104.91.71.132:443 res.cdn.office.net tcp
GB 104.91.71.132:443 res.cdn.office.net tcp
GB 104.91.71.132:443 res.cdn.office.net tcp
GB 104.91.71.132:443 res.cdn.office.net tcp
GB 104.91.71.132:443 res.cdn.office.net tcp
GB 104.91.71.132:443 res.cdn.office.net tcp

Files

memory/3548-2-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3548-4-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3548-6-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3548-12-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3548-13-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3548-14-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3548-21-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3548-25-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3548-29-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3548-32-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3548-35-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3548-40-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3548-43-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3548-46-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3548-53-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3548-56-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3548-60-0x0000000000400000-0x0000000000473000-memory.dmp

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{986364B3-E216-4CF4-8DAA-341623DD6587}\EDGEMITMP_B3D0A.tmp\setup.exe

MD5 1b3e9c59f9c7a134ec630ada1eb76a39
SHA1 a7e831d392e99f3d37847dcc561dd2e017065439
SHA256 ce78ccfb0c9cdb06ea61116bc57e50690650b6b5cf37c1aebfb30c19458ee4ae
SHA512 c0e50410dc92d80ff7bc854907774fc551564e078a8d38ca6421f15cea50282c25efac4f357b52b066c4371f9b8d4900fa8122dd80ab06ecbd851c6e049f7a3e

memory/3548-73-0x0000000000400000-0x0000000000473000-memory.dmp

C:\Program Files\msedge_installer.log

MD5 40c7cf24497a9a9472c3188efcea0f14
SHA1 debfdfca3b50718df625ef268616b5ccaf174bc6
SHA256 f186c0671d690a2f87e6302cb689834666bcb23a443c456040dca11446d5c43a
SHA512 2c511d02150bd07e9c6ed1ee863b5a527f80174e63ef9edab17966d76a03fbd2fd2123758220eff4d76417439542bd0bec8316d0bf4cce7f8a15e55eeb81a988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

MD5 ad5f7dc7ca3e67dce70c0a89c04519e0
SHA1 a10b03234627ca8f3f8034cd5637cda1b8246d83
SHA256 663fe0f4e090583e6aa5204b9a80b7a76f677259066e56a7345aebc6bc3e7d31
SHA512 ad5490e9865caa454c47ec2e96364b9c566b553e64801da60c295acd570017747be1aff6f22ca6c20c6eee6f6d05a058af72569fd6e656f66e48010978c7fd51

C:\Program Files\msedge_installer.log

MD5 33f021a1ee621e528ec2a53b3f6d2e13
SHA1 2c791c9e820f9e3280c4a19942d8a81c770bba09
SHA256 957e15e21d87a5bdf351d2569a4bbccc9fb656d48fb8c239daa3f0ed3999fe70
SHA512 83facae5f79ac4303b22c836a94a5fc7a8f41287585ebc854a58314e97fb6b99dc882e375556ac94e42e6cddd3a17a0ee52a55f724f3c05ce630af427e9ba7f4

C:\Program Files\msedge_installer.log

MD5 a3bcb0696d0a1cf3122ef7332585871d
SHA1 88031386f3b0e0dbb1cdc263baa39bcd14b4974e
SHA256 6c206f79d315a08246ba22c44fb0b37c00529d4c801955f529adc52c74c571ca
SHA512 ad4034bca7a085085cf392a61c49361386410b4b23dc6194dcfcfcb9da682e3aef0f7ec9585b2b690dac670da9ccce53132f039f166d9291ff4e4cf5e66f7b76

memory/3548-136-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2104-139-0x0000015246560000-0x000001524656E000-memory.dmp

memory/2104-140-0x0000015260A70000-0x0000015260A7A000-memory.dmp

memory/2104-141-0x0000015260AA0000-0x0000015260AA8000-memory.dmp

memory/2104-142-0x0000015262000000-0x0000015262249000-memory.dmp