Malware Analysis Report

2024-11-30 04:05

Sample ID 240408-bbv4taca34
Target Donkey_protected.zip
SHA256 f5ed381ed4a5c1efe12dd44a2abfb7c5b4f4225a8235e217aef3cbe93231b84c
Tags
themida agenttesla evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f5ed381ed4a5c1efe12dd44a2abfb7c5b4f4225a8235e217aef3cbe93231b84c

Threat Level: Known bad

The file Donkey_protected.zip was found to be: Known bad.

Malicious Activity Summary

themida agenttesla evasion keylogger persistence spyware stealer trojan

AgentTesla

Agenttesla family

AgentTesla payload

Modifies visiblity of hidden/system files in Explorer

AgentTesla payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Sets service image path in registry

Checks computer location settings

Checks BIOS information in registry

Themida packer

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Checks whether UAC is enabled

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Enumerates system info in registry

Suspicious behavior: LoadsDriver

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-08 00:58

Signatures

AgentTesla payload

Description Indicator Process Target
N/A N/A N/A N/A

Agenttesla family

agenttesla

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-08 00:58

Reported

2024-04-08 01:01

Platform

win10v2004-20240226-en

Max time kernel

147s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

AgentTesla payload

Description Indicator Process Target
N/A N/A N/A N/A

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A

Downloads MZ/PE file

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\fAlimziLhmaNbniTBKhWQgUk\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\fAlimziLhmaNbniTBKhWQgUk" C:\Windows\Globalization\Time Zone\niggerdick.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\fRDrjnlkWDbEZpIDdhieRSdpEkK\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\fRDrjnlkWDbEZpIDdhieRSdpEkK" C:\Windows\Globalization\Time Zone\niggerdick.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\jOQxbgVzbacqdmQlYYzXm\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\jOQxbgVzbacqdmQlYYzXm" C:\Windows\Globalization\Time Zone\niggerdick.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PHXWuZAcHHFkHJccAFgpgkpkIaOpB\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\PHXWuZAcHHFkHJccAFgpgkpkIaOpB" C:\Windows\Globalization\Time Zone\niggerdick.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\OaxDZINrCzEMh\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\OaxDZINrCzEMh" C:\Windows\Globalization\Time Zone\niggerdick.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Globalization\Time Zone\niggercum.sys C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A
File created C:\Windows\Globalization\Time Zone\niggerdick.exe C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-609813121-2907144057-1731107329-1000\{1916A550-7087-4B9F-9A88-8863387E046A} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\Globalization\Time Zone\niggerdick.exe N/A
N/A N/A C:\Windows\Globalization\Time Zone\niggerdick.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\Globalization\Time Zone\niggerdick.exe N/A
N/A N/A C:\Windows\Globalization\Time Zone\niggerdick.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A
N/A N/A C:\Windows\Globalization\Time Zone\niggerdick.exe N/A
N/A N/A C:\Windows\Globalization\Time Zone\niggerdick.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\Globalization\Time Zone\niggerdick.exe N/A
N/A N/A C:\Windows\Globalization\Time Zone\niggerdick.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A
N/A N/A C:\Windows\Globalization\Time Zone\niggerdick.exe N/A
N/A N/A C:\Windows\Globalization\Time Zone\niggerdick.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Globalization\Time Zone\niggerdick.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Globalization\Time Zone\niggerdick.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Globalization\Time Zone\niggerdick.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Globalization\Time Zone\niggerdick.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Globalization\Time Zone\niggerdick.exe N/A
Token: 33 N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2984 wrote to memory of 1156 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 1156 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 4288 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2984 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe

"C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Donkey_protected.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8424546f8,0x7ff842454708,0x7ff842454718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,957663318948310809,339743080962005442,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,957663318948310809,339743080962005442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,957663318948310809,339743080962005442,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,957663318948310809,339743080962005442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,957663318948310809,339743080962005442,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,957663318948310809,339743080962005442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,957663318948310809,339743080962005442,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,957663318948310809,339743080962005442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1988 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,957663318948310809,339743080962005442,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/gbr9ehnpB7

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8424546f8,0x7ff842454708,0x7ff842454718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,5943542772570052590,11029676270144490320,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,5943542772570052590,11029676270144490320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,5943542772570052590,11029676270144490320,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,5943542772570052590,11029676270144490320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,5943542772570052590,11029676270144490320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,5943542772570052590,11029676270144490320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2216,5943542772570052590,11029676270144490320,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5048 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2216,5943542772570052590,11029676270144490320,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4164 /prefetch:8

C:\Windows\Globalization\Time Zone\niggerdick.exe

"C:\Windows\Globalization\Time Zone\niggerdick.exe" "C:\Windows\Globalization\Time Zone\niggercum.sys"

C:\Windows\Globalization\Time Zone\niggerdick.exe

"C:\Windows\Globalization\Time Zone\niggerdick.exe" "C:\Windows\Globalization\Time Zone\niggercum.sys"

C:\Windows\Globalization\Time Zone\niggerdick.exe

"C:\Windows\Globalization\Time Zone\niggerdick.exe" "C:\Windows\Globalization\Time Zone\niggercum.sys"

C:\Windows\Globalization\Time Zone\niggerdick.exe

"C:\Windows\Globalization\Time Zone\niggerdick.exe" "C:\Windows\Globalization\Time Zone\niggercum.sys"

C:\Windows\Globalization\Time Zone\niggerdick.exe

"C:\Windows\Globalization\Time Zone\niggerdick.exe" "C:\Windows\Globalization\Time Zone\niggercum.sys"

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 discord.gg udp
US 162.159.135.234:443 discord.gg tcp
US 162.159.135.234:443 discord.gg tcp
US 8.8.8.8:53 discord.com udp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 234.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 162.159.138.232:443 discord.com udp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.130.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 233.130.159.162.in-addr.arpa udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.130.233:443 cdn.discordapp.com tcp
N/A 127.0.0.1:6463 tcp
N/A 127.0.0.1:6464 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 13.179.89.13.in-addr.arpa udp

Files

memory/3100-0-0x0000000000880000-0x0000000001180000-memory.dmp

memory/3100-1-0x00000000766F0000-0x00000000767E0000-memory.dmp

memory/3100-2-0x00000000766F0000-0x00000000767E0000-memory.dmp

memory/3100-3-0x00000000766F0000-0x00000000767E0000-memory.dmp

memory/3100-4-0x00000000766F0000-0x00000000767E0000-memory.dmp

memory/3100-5-0x00000000766F0000-0x00000000767E0000-memory.dmp

memory/3100-7-0x00000000766F0000-0x00000000767E0000-memory.dmp

memory/3100-6-0x00000000766F0000-0x00000000767E0000-memory.dmp

memory/3100-8-0x00000000766F0000-0x00000000767E0000-memory.dmp

memory/3100-9-0x0000000077314000-0x0000000077316000-memory.dmp

memory/3100-12-0x0000000000880000-0x0000000001180000-memory.dmp

memory/3100-13-0x0000000000880000-0x0000000001180000-memory.dmp

memory/3100-14-0x0000000006130000-0x00000000066D4000-memory.dmp

memory/3100-15-0x0000000005B80000-0x0000000005C12000-memory.dmp

memory/3100-16-0x0000000005AE0000-0x0000000005B46000-memory.dmp

memory/3100-17-0x00000000066E0000-0x00000000068F4000-memory.dmp

memory/3100-18-0x0000000006100000-0x000000000610A000-memory.dmp

memory/3100-19-0x0000000005D90000-0x0000000005DA0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 1e3dc6a82a2cb341f7c9feeaf53f466f
SHA1 915decb72e1f86e14114f14ac9bfd9ba198fdfce
SHA256 a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c
SHA512 0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

\??\pipe\LOCAL\crashpad_2984_LYTFDSDHRJAQFYWU

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 36bb45cb1262fcfcab1e3e7960784eaa
SHA1 ab0e15841b027632c9e1b0a47d3dec42162fc637
SHA256 7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae
SHA512 02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8dd2d29574a618fe0dad92f86163b692
SHA1 f061c787bcca8c844103534b65dc38dd835b3b8e
SHA256 ba39a387030b914f9a442e4ae11a035924effc1e18ee5c44373ae9ec96b57ae7
SHA512 128cbc068fa6caa1148f392203e4259964ea0d33d34453bbbdbbdfced68b60d2b3d4d97caf6ee3430d00ea9f986a3770fa5d6ddeb9073df42deb9d9d825ec557

memory/3100-46-0x0000000000880000-0x0000000001180000-memory.dmp

memory/3100-49-0x00000000766F0000-0x00000000767E0000-memory.dmp

memory/3100-50-0x00000000766F0000-0x00000000767E0000-memory.dmp

memory/3100-52-0x00000000766F0000-0x00000000767E0000-memory.dmp

memory/3100-53-0x00000000766F0000-0x00000000767E0000-memory.dmp

memory/3100-54-0x00000000766F0000-0x00000000767E0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 cab4be0749f1939a2d136f3762098694
SHA1 a57747cffd97f20101011e5acffa6c24f63c55c2
SHA256 9a37ff1c8ee8daf6f4b2eedd02e315d1af23c42a0fffd3a2f203a803232c8864
SHA512 3abf80b1f6dd24350dff718b509fe2a727a353ee0e9bb70cf94d52f1a9018873f77e17bb347a296378af2aabdb4d0d2a9a855f72a5e2a33b51b791f3ae4adab0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 feb4709837537287c797e017fe37bf80
SHA1 2b4beb4e9e56c919fb2e1327acf7fad392b1c098
SHA256 e526f47d068110a699b5cbeb821f0c3279acda426d8ba9648735adf911f69c60
SHA512 74ef3b3ee022690e18fe03679bcdee50275a05fe44fad42baadbe50d6eaf4490982abb70bd1e41f92a38cf52b61159cffa3f07d87104ae7abae8f5f02034839a

memory/3100-69-0x00000000766F0000-0x00000000767E0000-memory.dmp

memory/3100-70-0x00000000766F0000-0x00000000767E0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 3a21d2f16539f80333695377c6df54a6
SHA1 c89f2eb5c101bf8e9b94b88bb3079e8951e7cfbc
SHA256 bb63b60d01463af1d602ea060cc14c95381cf1b3c63384d8e81eda99a5d33224
SHA512 02f192db7668d6472e8b8ca4e3071c3ab45fabe6d787362843b3e9e844db8ef1c2d49ac88f9711436f38af16b7ec662de6668373af2868f44d0f94ab4560dd15

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 00a455d9d155394bfb4b52258c97c5e5
SHA1 2761d0c955353e1982a588a3df78f2744cfaa9df
SHA256 45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed
SHA512 9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 8ba411ee498a1e80b19f2e5c8a326f11
SHA1 abedfdc62abb873f1d84d50b6a261024dad7f230
SHA256 435a786fe330474eed5aae3096d579ae0e74f2f59f0f1414356b8381e251d999
SHA512 1c7c59984c89d63a755edcfadd854f5a44712415251e7680e7ed04583f418cc4af9b0d004fa66976b99c69f0ed816065bb38599b286171faff83506f29701ba8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

MD5 838a7b32aefb618130392bc7d006aa2e
SHA1 5159e0f18c9e68f0e75e2239875aa994847b8290
SHA256 ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
SHA512 9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

MD5 d982e14981e941f2975a2eac6bd95196
SHA1 37813f3e2e769b9424d578078291c745b9a6b414
SHA256 d6d1299ed3c1e87993d9e7709ffee28b3b3c9e476e863f51210f54597acca822
SHA512 1e1ebbfea7144a974720d9a5be312bca8265d3591871ca26c46f5aab21e0a8879f6acd7729904cb688afda16b86b89ecb0eea22c4bf45a52154cb2bbdad22128

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

MD5 b76b7257bd1256260a9b787ef9c84935
SHA1 2b7e87a5b8806defc029add9685d5cb19bc36f95
SHA256 2c0c65024628e019e82195e07c3a12e013b07f33b17c0685a5f78a3c90f1545f
SHA512 48ca98690376fa744f60e7f534722e74d39cf4da0349b01e3c2a566fc9c8722821267294825c672e548655073fb16febcb98f5f94f4d0d2f89b1c4676dc410e5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13357011552871720

MD5 fcc067987d157a68f578df95b0228e89
SHA1 82ba1a6d956dbcb874ffd1f40656e2fa1066b969
SHA256 8992d7d29cd2473ee11fe4bc869fefb8bd9bc9efb9780219af0d5bb6858b208d
SHA512 69c836cfaa326fe8933311901e3e9b6a8526c4c5e81facd6e3b159abeb89348961d26d45fee8507dda330f656915a6459e7a06654c9909fb7ef096c77cc0c36e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

MD5 32251989adc10037eeb480cf5ee53d9c
SHA1 07944b8e73f0fac2e88fe56bc709c81474702aa3
SHA256 94e999c52468d1d2961077d2a67f2f75ebdd089d2187f2d439508ec538aed26c
SHA512 4e75e7946805cfda57f0a6bba318af682a18e32904befb6c19518ac754127e4e7b70f81507c56c1a592c38f7453f2daa016394ae209fcd6f488df546b1c7929d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 97a504d4652ea0aadd92dfaa297aca77
SHA1 f90f3f5a49125b44dd42be9886f08335529b8a84
SHA256 b5094802148d9fca7e6749e88a9251cd6de7a322a4dc078434e720e5f1b96585
SHA512 c1573ae938a3a8ad92c6e1616568269512a27af54cae5db6c09ac413044b579f932460eac2a1aba229e2fdc87ba83a8a88271b58827c0839adb8db44dacff4f1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

MD5 b091be2c2c4fb8671471bd88650710b3
SHA1 0d18f13feb4fa44f61ea80f39e066931c2cba72b
SHA256 214c66f2c5e646d90899fbd2b4806ee0c8025af279c270ed5292ee53b0820c55
SHA512 47eb9af1c42ee92c215278e051fa3e14c1ffb643aaebd2a37ca0c90a52be92a7722f42da644bdaf2a4b76dfacf3622c6a1a2c624ad4e03aea1c0d149e45700fb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

MD5 c73b5b13a06cf09efee9cd6b3650c473
SHA1 e55d014d630cd289a68477b2f99a0b8594410471
SHA256 0e9d1c001d4b52a33dcba313e824bc7104cf1a8e0090215b03fb86793f55a770
SHA512 763ecd4a73d7da4e0bed1c6974aadc53bbfbccc44f03a3d380ac68903aec29bcc2fdf0039f0c7c1244a42943b7608c8bd73a04752cb5888ca03343f9eb1927d5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

MD5 0dc101ab6426b4c102e96c19b8f7e5d9
SHA1 b86c691bf9ec17f2a8ec4c412a7c69719617c80b
SHA256 a5ed0d3bf5a2f58c8bf2413bd984270e1c5b02ee0811b0a42c729b6cc7cbe2d5
SHA512 a596547014c8c4d26dd6d2b8f59026fcb3bebec7525867518b0815e12e4534fa09e29251f16cfa66b8688478fcc2cf74f6f9e28153c7c39abcd1219f7cc5ba73

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

MD5 6a0a11dc37ef4465d6e0266415873df1
SHA1 7aa192a7bd979ffe453476e7dbe8afdc2eb38200
SHA256 dcb5ba29f1a71f273c2f7b7dde7fd2ef3028d92d33fd18cbdd6e3640626ab004
SHA512 3e982625df17971dd0877d260d5439d0dd57457fc5454777c0acbac293ed0a65b132b5010b65fae01a034eae086c73d87377d908d43cec027e36aed59ffd0920

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e84cb769f67abf45975464d640059e22
SHA1 597742fdf5da729ee0d400bd2ac21c285f5cbee2
SHA256 ece1f3d45ce99f5fd25c7e5deb457122505f21fd8621b835630ce328502b16b3
SHA512 4b8b1d4e0e2793c2aabe3f2adf6f0e124976b70b05e1609e7ccb6507ea81fdd1017ac762b9ec19d7d11a00dfe81c769693a539564b6cbc33fe00629fe7680f0f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

MD5 d7d9437445aa960dcea52ffe772822dc
SHA1 c2bbf4ac0732d905d998c4f645fd60f95a675d02
SHA256 4ff49903bec1197017a35995d5c5fc703caf9d496467345d783f754b723d21c1
SHA512 335eb1ba85670550ed1e1e4e14ea4b5d14f8306125bf147a42de4def5e5f75f14c422b014414030cf30378c04f748ac875cf056adda196511a0b057b3598fe9a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

MD5 b7f2ffb608324ea469ba517e1cd83029
SHA1 221ba9a892c8d40fdc5aa6d375c97aea2d128555
SHA256 6ed977058087b1b85e831fb292aaa5839555b9e4dfb1dcfa115bdbbb3132840b
SHA512 84efdbf2ceef5721b8c60a0843f394f6cd7d220114dc4b0497513fd5abf5936eb2914a639638bc2d60889083b1aaa57da1aed74ffd101535b0eaff277084bcfb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

MD5 64523d805703afdb0bf5e52765e554f4
SHA1 5addfba99493a214c01de49e7d872519464f262b
SHA256 995074d1a445822ebdda071a9953c034f7bbd797223c35df24cc28b187b83a14
SHA512 5ea451d745ce36c501f68bd148334982b29306647df8e7e8126edd5760fc708d498a4f5316d37f270f5921adfdf680cf2b6032c5019c40eb4888c5e25bab3164

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

MD5 116f9d0228a3aa434f6fada0a4720a56
SHA1 38112ab2b0a345f2890519721e4a2be479b4a5b5
SHA256 d985fd711f4ac4a664f8625ba0a7c3971a0d9ec39808b8007d4b1f10c0ef0cfe
SHA512 f2136563ec234a77b16117193944f412768992b3893c4b716d16bc227d09ca5390a889a70e40f5fe56e01dc2013fa35116dd8305c1d5d06a3a208063d101c959

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

MD5 862b1de80b79ec96e08a81596322ea49
SHA1 2ac9cf97ca60c2065d4e56fbd3d126f8c976fc8a
SHA256 9b90f6a1f95d2fdf9231365554c70ad337bbf3cf7c5bcb1b1d291b58b414dcc4
SHA512 d3f6e3a2eed2cce8b6b133c4456f9cfe2499236bd844a1255248a59f50a2a6932da8b598908a05f850282b5de0ebc895fd641c3749d3745641202b8cb65a18e7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

MD5 a9851aa4c3c8af2d1bd8834201b2ba51
SHA1 fa95986f7ebfac4aab3b261d3ed0a21b142e91fc
SHA256 e708be5e34097c8b4b6ecb50ead7705843d0dc4b0779b95ef57073d80f36c191
SHA512 41a1b4d650ff55b164f3db02c8440f044c4ec31d8ddbbbf56195d4e27473c6b1379dfad3581e16429650e2364791f5c19aae723efc11986bb986ef262538b818

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

MD5 6931a24a083dc3c1c78d3a0f1eedae91
SHA1 cfd354c006d584425d17308df21dc273a0595767
SHA256 56ff7a9761cd7b5f6ec15cb0990d9ba3c3d7d6477867918b1296cb08071fe525
SHA512 64f0a2b7062f9ff6f8969b6abe855bbfc08fb5c079cd1dcc9f58a19c6e4834f1e233054cfd8c5076fbb8c2c1e5c8f9c7d34387a3320f6a5623007e7bdf2b3d16

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

MD5 5c33f05e79f3503bbde70811bb5c0fdc
SHA1 97e6f01547f9f3cd48d0412ce66037fe9f807307
SHA256 f66821707c85223c8fdeb9da01172c52dafeed24f1117ddd4b7b189199da7e0c
SHA512 908c787e5df6a253da972847fa07f40c7ddf3c82699dda855aedb8160cb1934e4be15058ea502b8802a3612d909a7e1210e2186a9fe824f84d09732df8b7accd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

MD5 600fdf0ee93650cf4887610747c696d8
SHA1 c90a1c28161fd697c66cbd7b1f603de898098b22
SHA256 d8d0c66627735a70ad28c004def17024ba62e2863a9c73cdfd6bda06511c8eb0
SHA512 8cae55e4cc65a433492961cfd1ff16b8ecee7ec858d269858144d3eaaf5c9dfcc84dd31b7da736d04cad6e32ca5d4ff39484d919a623de766280ab8751d6144d

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

MD5 4c7219aa8d867b6644968283fa9baa9e
SHA1 90ba30a437d7395fa897576c629268b1a8cf5e6a
SHA256 a074c6b7bf5e026681ff302d100620ee6a159b2b4c1af49c5648f649379a67c8
SHA512 23a7a6cf569757246972e5e87975c0aeb03b36cfa9c8ce28b361e8da2317d088c998619c7bef649f3902b829f5cf2ff5047f1666b824b3ab613935ada71f2a12

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

MD5 adc84c8bff5991e3577320a2b150ffbf
SHA1 29dbff2dbf36098b34ad0cbeb46f1425b97b6a41
SHA256 f7c3e20940fbb8b1719958ac6973031f8061e464187bf542bf52b08e15bfeee1
SHA512 930cb1436b67a28bbc5e5945c21490cfc30fea7b08b0be094cb39c55822a690ff165179401c19fb48932fca7ed244cc9ff55f49b16df3a558408531dcbe76bf2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

MD5 eb443c0e9779babba7d714cdbf8f4a01
SHA1 ec175b068b60847a7681f866bb69a36b8e43aa04
SHA256 dfa15374407a064e870f120565a50327a932d39af2708830bb2898038511bab3
SHA512 fd1e549dafee61345bc6d6b6c38501e3f4bbb8a2eb27fe6c8b30480634f9a6ac7ecd803587e153a136fc1fba2a1d5a70d80c47023ab99ae36215104ca50fd650

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

MD5 cc9c28687462afffae845afcffef4e4d
SHA1 abb318f397dd6d88010d45f96bf57f6b78f4130d
SHA256 8f7692754ab11f47cf3d50ab7a816e24d3faee00ff5dbc2938c3b7276617c664
SHA512 b07f56eedf65e82e695982770cb45682713a604e136eb5a9574de127c9240fb1057d0089900334566e162fa36b080118b8e245a6e333edae3a4d589ee2f94896

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Reporting and NEL

MD5 508a64156e99c084f986f48c18a8abcc
SHA1 4d85fc7bcd526d89ecc80331b22a7d9ff22382ec
SHA256 5e8910201b8813f9418d0eee64839b800d4aa64526a607450553b47b7d900c0d
SHA512 1b8a03b6c464c8cb109e9765ddce90c7990a4cdc52b8ae891d67adc107df3972f8d74de444a2240597a7a784547b6675c115fdd51e1d617943bdcf4b3337b6a3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13357011552639720

MD5 ef63591e9117fe4e54e6b8a40b11e80c
SHA1 4be7c70cafec8f9d8a18fff963c162114c0732af
SHA256 c8d5f7f93efdb0c3910511b6b654d89d266ce4a3e5300149f08f9ea02b94d17e
SHA512 fec5a9922559a914e693e9d5b76c7b6eb33f492ded6863aa10a3241606c9236d3d846faead137fffb28876a129977ab45cb4939d8df64b3146d1609f4cc58653

memory/4488-240-0x000001E3DC8D0000-0x000001E3DC8D1000-memory.dmp

memory/4488-241-0x000001E3DC8D0000-0x000001E3DC8D1000-memory.dmp

memory/4488-242-0x000001E3DC8D0000-0x000001E3DC8D1000-memory.dmp

memory/4488-252-0x000001E3DC8D0000-0x000001E3DC8D1000-memory.dmp

memory/4488-254-0x000001E3DC8D0000-0x000001E3DC8D1000-memory.dmp

memory/4488-257-0x000001E3DC8D0000-0x000001E3DC8D1000-memory.dmp

memory/4488-258-0x000001E3DC8D0000-0x000001E3DC8D1000-memory.dmp

memory/4488-259-0x000001E3DC8D0000-0x000001E3DC8D1000-memory.dmp

memory/4488-260-0x000001E3DC8D0000-0x000001E3DC8D1000-memory.dmp

memory/4488-261-0x000001E3DC8D0000-0x000001E3DC8D1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 646aada46ee19ae545271e222ff3f317
SHA1 2612f631bded431354b6b1386404a0a22a9ad83f
SHA256 61d529ebc17c885a716e3d3b1110764277ac864d395bff3d9a9ec27c1cdf85db
SHA512 2e2754e4688487cf291e383395a7d40ae81d4b0ab9f7f553b265183ec313e83ec33e1a1e5024e32a091d686817020685bfe3fab7e5da7270cb8fbeeaec6305c1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 2935a0959b64af6088740ca31fbe1b1d
SHA1 92e67888c45775df9de378dcf5ad5037c9b35f31
SHA256 9961c6d868036cf15b2012db2ef1e7d78c2223ba0ce4fac7a686f75b45d43c57
SHA512 e6154c537cdacc8f8fee8f905bb463f1b9962702e117e1a5705f1c3a6ba0403c0a0f44642f89e54a8101cb67112c311e71929b52623acf549ddc37a74edd2967

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Reporting and NEL-journal

MD5 a822c8f7f333ba4a0549e345632f32d6
SHA1 21e748230fdf98982c955cdedd194b1e71c4fc2b
SHA256 539a44664e308220f86071989a58b8424425d526ec40d3d7a74facb3a69aa48e
SHA512 76302387e6449063c491268460ad92f4cf7f536f4ba2e489220fbd4b53b77203e7da7799116eb9c61fdd32f4123934cd03013a4f650375dd587e5826d32b7b1b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 23f2cf2bb57ba5e020921b82c46942e5
SHA1 a4d4aa1c81528bf227d96cc2074697e6f3ec278c
SHA256 e05102352aef3ba81e5012c10bcba8e80e38dff7b5f23264c0aa9486358ae99b
SHA512 7c6a6ccefb16a3be1bfbd4c1c9cce97982bb4d6d43be16fad6f656c66e89d8ef5af29c42a1ace7964a30f4d00278624b407d7e574216807e6c4938fcb32da02d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 74a02e0fec906b283a0d6b1cc7a05ebc
SHA1 f23c984979dea679004a4bececa6393fddcca645
SHA256 ec3425f61d606de3976bd5d46800d5da0c835604c528a7ffa11820bf751ce409
SHA512 51b24c64528a8b84af9581113e530620b388b73ee913556c3eb16708ae221cc994cf0fe2e8fc8848e894ef8a55c821ba7a918dc5bf33e62ebf712049fac5dcec

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 f966c2a09ebf1ac6fe13573cb59b9d83
SHA1 e8174414c1a78c9a180733064b72f2329329bfa7
SHA256 2c868e6560919f14275a258063189d31a007912e001e739d86493ecdf2ef2290
SHA512 8fcd886704d560464489a8c2fecce9e2ed6c578913a6fc98e65a3b1c34f7e0a8d590681d15b8db88ac466664e2a7d77fd56605dc38af09b7f36f5741b8dc9df5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt

MD5 e57f9e4aa3f8b7581c2fd2285000f140
SHA1 7695abf93485cb05e960c0d286becfe2419bc4d7
SHA256 ab43aeb88bb33d8fbbc2337b9000b4d729e0e848a65984a19db5e653a24e3ffa
SHA512 8432dc9f94fa1d1884ae9b13fe06f043e823e2a1385417a26a4407aacd35f6cee52498f2cbf61eae67e42560b674d5c3a121543bd6b8e515410a4f7255e91365

C:\Windows\Globalization\Time Zone\niggerdick.exe

MD5 7ece80f40410747dd46799abef38d2c8
SHA1 2d85a6078ff678ddeed2818af5473fb9788124d0
SHA256 437ec0b93bb08100f78979d23ceecb76d10f22bde82320ff8f400a0a53992088
SHA512 a0a3dedc8eb6afdb885a309f3748a225cca0d61e76d2978f47dd9f2d980d531b5c83c84ad461735fb5adc5632cfc9631028d1e68899034c1cd91be3bb26a3a22

C:\Windows\Globalization\Time Zone\niggercum.sys

MD5 1e402317bc8f085423f5de859b20c3c7
SHA1 a52070e376ace27d79aee94e452956c7f5f60cf6
SHA256 9bc41d97456ae7256b654e7b4ae1c904611832e9cf0cd9f67b2fa988cb0251a0
SHA512 00819aedab541e9181c9d41fb36897872556ba49c41a6a0b254d0c9cd707823d59b871a10b13cd4d103e1a6cabc36515bc0e0af23758e59c42f3f5e362e0271c

C:\Users\Admin\AppData\Local\Temp\fAlimziLhmaNbniTBKhWQgUk

MD5 1898ceda3247213c084f43637ef163b3
SHA1 d04e5db5b6c848a29732bfd52029001f23c3da75
SHA256 4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b
SHA512 84c3ccc657f83725b24a20f83b87577603f580993920cc42d6da58648c6888d950fd19fbb8b404ce51a3eab674066c5cefe275763fbdb32e1ae1ba98097ab377

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-08 00:58

Reported

2024-04-08 01:01

Platform

win10v2004-20240226-en

Max time kernel

99s

Max time network

103s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Guna.UI2.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Donkey_protected\Guna.UI2.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 130.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-04-08 00:58

Reported

2024-04-08 01:00

Platform

win10v2004-20240226-en

Max time kernel

99s

Max time network

100s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\svchost.exe N/A

AgentTesla payload

Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\svchost.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
File opened for modification \??\c:\windows\resources\themes\explorer.exe C:\Windows\Resources\Themes\icsys.icn.exe N/A
File opened for modification \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe N/A
File opened for modification C:\Windows\Resources\tjud.exe \??\c:\windows\resources\themes\explorer.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS \??\c:\users\admin\appdata\local\temp\donkey_protected\nword_1.exe  N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer \??\c:\users\admin\appdata\local\temp\donkey_protected\nword_1.exe  N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion \??\c:\users\admin\appdata\local\temp\donkey_protected\nword_1.exe  N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3760 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe \??\c:\users\admin\appdata\local\temp\donkey_protected\nword_1.exe 
PID 3760 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe \??\c:\users\admin\appdata\local\temp\donkey_protected\nword_1.exe 
PID 3760 wrote to memory of 4116 N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 3760 wrote to memory of 4116 N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 3760 wrote to memory of 4116 N/A C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 4116 wrote to memory of 3152 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 4116 wrote to memory of 3152 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 4116 wrote to memory of 3152 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 3152 wrote to memory of 4404 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 3152 wrote to memory of 4404 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 3152 wrote to memory of 4404 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 4404 wrote to memory of 832 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 4404 wrote to memory of 832 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 4404 wrote to memory of 832 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 832 wrote to memory of 3560 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 832 wrote to memory of 3560 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 832 wrote to memory of 3560 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe

"C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe"

\??\c:\users\admin\appdata\local\temp\donkey_protected\nword_1.exe 

c:\users\admin\appdata\local\temp\donkey_protected\nword_1.exe 

C:\Windows\Resources\Themes\icsys.icn.exe

C:\Windows\Resources\Themes\icsys.icn.exe

\??\c:\windows\resources\themes\explorer.exe

c:\windows\resources\themes\explorer.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe SE

\??\c:\windows\resources\svchost.exe

c:\windows\resources\svchost.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe PR

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 130.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp

Files

memory/3760-0-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Donkey_protected\nword_1.exe 

MD5 fdfd741a15a0da88353f23fd1868c052
SHA1 af4e4b610d29079e447a1021780a59ca91a9631f
SHA256 5f81da3c4b5e80964626fdf811ca5f790e7b47938ed987c39b686f30e28d4ddf
SHA512 a8c97c9653a62c4d435f211707ba8f3984716b08fdffacfaa2b0ee4013cccb98fa3cdff00f7006110288450c8c7aac0c319ac949787829ae8e94e65b9ce0a32e

memory/2708-9-0x0000026BF9B70000-0x0000026BF9C62000-memory.dmp

memory/2708-10-0x00007FFE030E0000-0x00007FFE03BA1000-memory.dmp

memory/2708-11-0x0000026BFC690000-0x0000026BFC8A4000-memory.dmp

memory/2708-12-0x0000026BFC460000-0x0000026BFC470000-memory.dmp

C:\Windows\Resources\Themes\icsys.icn.exe

MD5 abced5825a4d7ead6c9b5cf3385246d1
SHA1 bd42caae2cd650aab2ad33c035bf94c5348df4ca
SHA256 4d78ef27394a9e62fd5c58d7475c7834c1ad54a045750507569af18310703ff6
SHA512 3eb9cb1068c7ccd0a34dcba1f7badaabc46aa75e193a4620ec28bfdae4b03fc60f74b5e9ac422c8609c9d135abf840d76331699b16561a594e46dd71a620ede9

memory/4116-16-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Windows\Resources\Themes\explorer.exe

MD5 c2e29b47555369220847bddb0fbe8fab
SHA1 e7e3d7495f6c65d06780396c93b45452b5a72ee9
SHA256 4d6b24a0e845a571e3d24a658e92422fd7aac1fea2c29abef0cb2c8bda910632
SHA512 717965dab2fad62e263c26efa816a026b1535d6c5247c20aaeb7481f8efae879a25a677c64006a5b527143fb0297780a52fc1833cb37314249066a2bbbaf510f

memory/2708-28-0x0000026BFC460000-0x0000026BFC470000-memory.dmp

C:\Windows\Resources\spoolsv.exe

MD5 46876f4265f316d7f5738859e71d3ce4
SHA1 636198b62a462cb3d0c09ab4bbb3d97bb70e5f9e
SHA256 f287b9de8ae6136fdb811b95b819eb6becf31c0b0150fe1fe0e38b411df6896d
SHA512 cec93b79667cfd2cc62778411ba11242cb4c2bc9c6c0b457479d0fec518f83cd5b186c5670d4e5f1b839e732a82163f9a66e0b061ea33b5e8339a0b020c48082

C:\Windows\Resources\svchost.exe

MD5 abd4e1baa71163a671f349ca0857563c
SHA1 8561f5048f5cefe64d61146c72270a7c17ce4017
SHA256 8f76a2fa7e9bb43339663414086f07b7a0eca83c0b5fda4f105a5f2e8a023307
SHA512 3aeb8ed8a6006e935b01b628ffd11e067c43e49f5b6a019970905d4b1c6ccd2a057aab7f55a23d5ccbe397908122c0188f69c7522fd8d22762ab2be02043024d

memory/3560-49-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4404-50-0x0000000000400000-0x000000000041F000-memory.dmp

memory/3760-52-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4116-51-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2708-53-0x00007FFE030E0000-0x00007FFE03BA1000-memory.dmp

memory/2708-54-0x0000026BFC2B0000-0x0000026BFC459000-memory.dmp

memory/2708-55-0x0000026BFC460000-0x0000026BFC470000-memory.dmp

memory/2708-56-0x0000026BFC460000-0x0000026BFC470000-memory.dmp