hxxps://www[.]donutsmpclients[.]com/

Resubmissions

03/07/2026, 11:17

260703-nd5r9acy9n6

03/07/2026, 11:14

260703-nb5pgacy4n6

Analysis

user interaction
yes
max time kernel
52s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.donutsmpclients.com/
Sample260703-nb5pgacy4n

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
59	raw.githubusercontent.com
60	raw.githubusercontent.com
61	raw.githubusercontent.com
62	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2720	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275508728427626"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{34800948-2BB5-4B84-8D3A-B300904C9F93}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 3784	3820	msedge.exe	86
PID 3820 wrote to memory of 2720	3820	msedge.exe	87
PID 3820 wrote to memory of 1884	3820	msedge.exe	88
PID 3820 wrote to memory of 1884	3820	msedge.exe	88
PID 3820 wrote to memory of 1884	3820	msedge.exe	88
PID 3820 wrote to memory of 4200	3820	msedge.exe	89
PID 3820 wrote to memory of 4200	3820	msedge.exe	89
PID 3820 wrote to memory of 2200	3820	msedge.exe	91
PID 3820 wrote to memory of 2200	3820	msedge.exe	91
PID 3820 wrote to memory of 2200	3820	msedge.exe	91
PID 3820 wrote to memory of 3744	3820	msedge.exe	92
PID 3820 wrote to memory of 3744	3820	msedge.exe	92
PID 3820 wrote to memory of 3744	3820	msedge.exe	92
PID 3820 wrote to memory of 2468	3820	msedge.exe	93
PID 3820 wrote to memory of 2468	3820	msedge.exe	93
PID 3820 wrote to memory of 2468	3820	msedge.exe	93
PID 3820 wrote to memory of 1940	3820	msedge.exe	94
PID 3820 wrote to memory of 1940	3820	msedge.exe	94
PID 3820 wrote to memory of 1940	3820	msedge.exe	94
PID 3820 wrote to memory of 4852	3820	msedge.exe	98
PID 3820 wrote to memory of 4544	3820	msedge.exe	99
PID 3820 wrote to memory of 4852	3820	msedge.exe	98
PID 3820 wrote to memory of 4544	3820	msedge.exe	99
PID 3820 wrote to memory of 3860	3820	msedge.exe	101
PID 3820 wrote to memory of 2496	3820	msedge.exe	102
PID 3820 wrote to memory of 2496	3820	msedge.exe	102
PID 3820 wrote to memory of 2496	3820	msedge.exe	102
PID 3820 wrote to memory of 1180	3820	msedge.exe	104
PID 3820 wrote to memory of 1180	3820	msedge.exe	104
PID 3820 wrote to memory of 2928	3820	msedge.exe	103
PID 3820 wrote to memory of 2928	3820	msedge.exe	103
PID 3820 wrote to memory of 2928	3820	msedge.exe	103
PID 3820 wrote to memory of 3064	3820	msedge.exe	105
PID 3820 wrote to memory of 4124	3820	msedge.exe	106
PID 3820 wrote to memory of 5064	3820	msedge.exe	108
PID 3820 wrote to memory of 4108	3820	msedge.exe	115
PID 3820 wrote to memory of 1168	3820	msedge.exe	116
PID 3820 wrote to memory of 2112	3820	msedge.exe	117
PID 3820 wrote to memory of 4768	3820	msedge.exe	121
PID 3820 wrote to memory of 4768	3820	msedge.exe	121
PID 3820 wrote to memory of 4768	3820	msedge.exe	121
PID 3820 wrote to memory of 708	3820	msedge.exe	122
PID 3820 wrote to memory of 708	3820	msedge.exe	122
PID 3820 wrote to memory of 708	3820	msedge.exe	122
PID 3820 wrote to memory of 1316	3820	msedge.exe	123
PID 3820 wrote to memory of 2964	3820	msedge.exe	124
PID 3820 wrote to memory of 3296	3820	msedge.exe	125
PID 3820 wrote to memory of 3296	3820	msedge.exe	125
PID 3820 wrote to memory of 3296	3820	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.donutsmpclients.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9e8d6c188,0x7ff9e8d6c194,0x7ff9e8d6c1a0
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,468379363867090140,15723728462575294272,524288 --field-trial-handle=2248,i,11295136637079953387,9506749117484966653,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,13767177005582430927,7589063876178485780,262144 --field-trial-handle=2248,i,11295136637079953387,9506749117484966653,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,12960575582800773485,5271663246501283730,524288 --field-trial-handle=2248,i,11295136637079953387,9506749117484966653,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,16823873736121948514,101259195614392886,2097152 --field-trial-handle=2248,i,11295136637079953387,9506749117484966653,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,994780446286509749,12454584034106901855,2097152 --field-trial-handle=2248,i,11295136637079953387,9506749117484966653,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,11573362940999682004,9046524750854942502,2097152 --field-trial-handle=2248,i,11295136637079953387,9506749117484966653,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,5696076290504733028,9900016382391643749,2097152 --field-trial-handle=2248,i,11295136637079953387,9506749117484966653,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,5889410868377345772,5768153812584631434,524288 --field-trial-handle=2248,i,11295136637079953387,9506749117484966653,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,7892880829227049571,12839433391384739711,524288 --field-trial-handle=2248,i,11295136637079953387,9506749117484966653,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,15268689847643724799,16650423098388766481,524288 --field-trial-handle=2248,i,11295136637079953387,9506749117484966653,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,15268689847643724799,16650423098388766481,524288 --field-trial-handle=2248,i,11295136637079953387,9506749117484966653,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6200,i,18242564277129577541,13386901541509449668,2097152 --field-trial-handle=2248,i,11295136637079953387,9506749117484966653,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6168,i,17674645618542178830,15141955398306186620,2097152 --field-trial-handle=2248,i,11295136637079953387,9506749117484966653,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,13433400987632579579,1281531880220287687,524288 --field-trial-handle=2248,i,11295136637079953387,9506749117484966653,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,13474452519758410167,7158589405894487878,524288 --field-trial-handle=2248,i,11295136637079953387,9506749117484966653,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\kryptonclient.jar"
  2⤵
  PID:4124
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\kryptonclient.jar"
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,8480305774568791981,18010280730016641558,524288 --field-trial-handle=2248,i,11295136637079953387,9506749117484966653,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,6976040425944510317,12247376626676798486,524288 --field-trial-handle=2248,i,11295136637079953387,9506749117484966653,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,2312603177647746132,5627906555897302808,524288 --field-trial-handle=2248,i,11295136637079953387,9506749117484966653,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5132,i,14789591935913397080,2333873696372614607,2097152 --field-trial-handle=2248,i,11295136637079953387,9506749117484966653,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5284,i,3581382294488445405,16695948921792770837,2097152 --field-trial-handle=2248,i,11295136637079953387,9506749117484966653,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,9893290958898489031,11551384019270770182,524288 --field-trial-handle=2248,i,11295136637079953387,9506749117484966653,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:1316
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\Fakepay.jar"
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6376,i,6692900579094944996,4263983529335272743,2097152 --field-trial-handle=2248,i,11295136637079953387,9506749117484966653,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 84815619a0e0679640c78514e49b96960c9c87d02f9486c9acf80a7e52475199
MD5 365ca9c61e2a9a06df286bd78f60b0a1
SHA1 d57d440ec5e0d99d0a611f4b75020e6285f03c81
SHA512 312838bf2a6dd4a1056f2e8c025bad287d16706dae350c0bec9653e0306f566813bf58e6ba31b8893441455e05674f2f6ebf58826aa6193158e52bbdacd75fb0
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 165f8a573c2ba85f64f307da9c58f94b220d5354a7f23370c50a27535d1edf33
MD5 c8bea5bc449ff15460f13e08ad6d2faf
SHA1 fe7319b55dfee2bccbe3a1b2976214379413cc16
SHA512 63c6004a5be9f0a8456b7b9de5c930e4b03c3f53e7646fc2c85ddcd14a2745571379f144d72685ec66ae72014bfff7bbf225901bcc9de93af92e082c823f81af
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 61ecce8ea592c7294166a900332d5d7204ed0e827586d6a6952200e40294adf3
MD5 d107ebe95254411fbbf5c5194ecf68fb
SHA1 bd94ec176c990db9fafa3d79a1afe2e56f97158d
SHA512 0b26a614a812dd4121dda32c2334bc751af063e2662144597507056aeb1eb49e00b60805d5322a2d5c3148256b9503a34e95b0a8e456f217875cdb6c5dec7fa3
TLSH
T138713A580A92099DD3503230EDEE1F5671718BC42F5B8E023F74D8BCA9263F789E28E4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589a47.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589a47.TMP
Size 3KB
SHA256 9fb154edf52fbe5134bb4218560b802b2e1b006c3ff6f5c66a1abb92d8571119
MD5 2739eb6172fca7c707f257b40f3babb6
SHA1 28cebc1b736bba222759b2c03f64f96ea621af98
SHA512 0f8a77105848da222f4d5a6fd66e655a3ea509ba445711e10328a835c43177ea920028be934744b732f83216f9f4b931a5d1180a2313613720776ad1466cad90
TLSH
T155711A580A9609DDD3503230EDEE1F5A71318BC41F5B8E023F7488BCA5257F789E28E4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 064a19b5e5a3fce5bbe0382396e84bd7690b1cd97fbd6b09351a0f40973af2f0
MD5 bb324b1c4d4c94b0d2b863f3776bc830
SHA1 2f972b738145b9a98dbb27d0fa76c9a5bafa39cc
SHA512 2c40e7461a8fcc747de7ad49c0bb51ef8ecab833453b0497ebadc64e80a32c04f0925ce3ca80fa3e75a4a87f24324d3057a4c9f413b1ac061d54ebb956e22098
SSDEEP 192:sxZcPQR/gyM/jK1Ml8MkPG/fvRsn+ycarIdpUnc1HW6+WNyck1/YLxoc2T/A1Ig9:sxZP+Mu/fJsnnYlHbc/m9
TLSH
T1DE52F9126B34997BCCDBD209FA41BB53D6F94572E2901D44A9FCCA0C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ec41a73ca90d45ebcd1ed650c1a65bbb062b1606bde3032cd54e77972794f3fe
MD5 51c1bb2e3e15cab81d119f2f8144cc37
SHA1 7e43478e99cb5173d03a7debc974243468bd4b3b
SHA512 94f30fcbd0f9ce27b7e64923ac81485e7cf0e96b494ab8e30d3d9d6392e9fea1e27c55c2bafbb8f41f72b2e3db5a349d39e23bdec869810b870c986c16081275
SSDEEP 192:sxZcPQR/gyM/jK1Ml8M9PG/fvRsPh+ycarIdpUnc1HW6+WNycBIXYLxiyc2T/A1O:sxZP+1u/fJspnYlHbMXjnO
TLSH
T12552E8126A34597BCCDBD209FA41BB53D6F94572E2901E44A9FCCA0C05E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 060ea97748d9ebeb9855c2a0a2385512fcea7488a0fccec131efbabdbb566f9d
MD5 32ec60602379bef9b4e6cb8ba6856488
SHA1 93a4387803e00bbd72dcc09470c4102a064f5ee0
SHA512 c5bd71b8023a393cd35172068791abde1572a85780e2f121879c7ef16b912879ec3d66d6af02276ce594012db3f03e2fec5c3f8545e565f6491f04f05442a3c2
SSDEEP 768:a8s6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNVroV5p:a8s6pD1WvxzWju1jahILIsNuV5p
TLSH
T117D2FA3B680CCB7E4F841E5CAC2AAF977DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 f6b3d2b8bd13b6df8e95898daa3cb40169e492d8661d5cf5799b21dbc2992bb2
MD5 d0cec9cde2db6ca411c910ee0991fb69
SHA1 cf6f33acca6358e8be32a08310495f3aa8ede1cf
SHA512 2d455f5aa976b047ccdfabdfd2e18225ea5bf90dd4a09a35199236108ceb96b5cd826dbd5b3e2979d53f4825920a4cb015b6bf6bf07ffafff5ff5b42a11c961a
TLSH
T1F4F020BB6FE72920FDABE3E32470907106417D18C815FC0F186AB6C390B1319798ACA2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 5ee09c3d6f3ea88c9448c1299479d8ca25b46eddd37acd0338af0fc70ae1f725
MD5 d1393c613e39592e62db2165196ab268
SHA1 5b53653940eed2db639b61058b8507131e15997f
SHA512 5800c6d7f8d32f442fd27d73298faea4b4e565a183116db01c7888028ad93d442855e2d9c51c95df7de4e14459976b8b40b18b563b36d53836c33a99e5e288ee
SSDEEP 96:KUAAKtePe9OKW06aMgKtS6ioK3K+qKcKD6RxOf7Js:iiRlHWr3QxOf7Js
TLSH
T1DEE1470231BF06123D7E6B19A255877B4B92B563301DA42B7BE840714E6AE380DFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5a343342fdf5eac0b2be7958b7da8af7750946c1c6c461ed5acdbf5c3dde3595
MD5 622a5adf0f6b5021bd2a73ca6f12343c
SHA1 f5cb3a3e01808a7087b3ae148de6617c08f3ecbb
SHA512 c34003a997145ce9672a0a3cfd301e450263dacfd49c7d741fe449c2ee264f5e84cbd988c27ee418303bc59dfcf4c52c318123ccc11d6e96ffb3fa5b47cea5a9
SSDEEP 384:ZtNn/s3n9SfsN0OC94OiMa9xOsHeUFROObjI9G6w7O7:Zj+9UXcVrOqeUFR29Ma
TLSH
T174929F366C285D775DE29555F58B3A1B9FB841BBD2CA2F84D0EC9F0C02DF6AC1306906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ccea8d1fd28db9e45537bf52bd630311ed1da44053d43a7a91383ca0cd074039
MD5 9068891c7ee977f408d2cb742b6b6d29
SHA1 86bc70e847da80f200543b53ee70d4ab43007b5f
SHA512 c06e5ec430afd9ad6510100299c4d1c0b2eb3ffe4919a7602707ae9be7853500e099e5ffef45b722b9bfc7e8326684bae8da25d2983684239f10fc94625e4691
SSDEEP 192:qONQ6O7+3hQmiUycSc5Gttb0sO2b/WgGZWrU6:qONQ61dGt9xOsIOU6
TLSH
T15F02F83578286CA78EF2AD45FA8B37279FA5113BE9952F40D6E85E0C00DB65C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f2a4c7467644729bb5ef83745265c6bd722a989a0c1814a047446d06509aa8db
MD5 17e5440e6911b7411f376674ab2b05fd
SHA1 d9a452fd77f5f44e0e50f315964eb028f03387db
SHA512 64fcb414aa6f20d856a13d2d4bf838347e83aff7cfffdabe2fac71c51b95e917f21b932fb3a49355da94735e4adde4a6c2d865b4ce92d75fa6d43dace9eb486a
SSDEEP 384:ZtNn/s3n9SlsN0OC94hQd2a9xOsHeUFROObjI9G6w7O7:Zj+9iXjd3rOqeUFR29Ma
TLSH
T1BE928E366C285D775DE29595F58B3A1B9FB841BBD2CA2F80D0EC9F0C02DB6AC1306906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4d88b4a48129cf0b7bfd8120d7d03c041e904ea9f739681c7228a8a8a6e7b4fd
MD5 cb9c712b6387660cf21d5d7851b55f49
SHA1 00a826eb14a9c7a62b3f4d1eeab8f281fae9114c
SHA512 8231e52071df86747b2ac9d26217926d4b7a302de4cc8d82e0b139b7a59e099d860409bcf9c871e995bea3fa4dc8655b5f67f679838998102be26aa7a1303ec5
SSDEEP 192:uXONio6O7+3nYQmiUyc6c5uXttb0sO2b/H5E5cNZ9qT+RU6:kONV6+tct9xOsHeOFRU6
TLSH
T1B8122B3678686C775DE2A581F58736179E69412BEA8A3F80D5DC1E0C01DF6AC234BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7861e1d3708aa389bc84b6ee3aa556d8d3cd2b5e55149dc5cfaa445126e68aa3
MD5 ca1cf1c2b050c4905b093f53a6bb9afa
SHA1 2ae102a2d62ccdaaf25008f4112fc672cec9a9cc
SHA512 13656a2b7a316f55f44c53b002a97ebfc628bf657166e326506fcfb90cef52f3e4d5f273fef49b7a6b52ebb56b1acbfff5fe0f694a53ac2c588fec588e4e8d4a
SSDEEP 384:DtNn/s3n9SnsN0RC948Qd2a9xOsHePFROObjI9G6w7O7:Dj+9ASAd3rOqePFR29Ma
TLSH
T14B928E366C285D775DE2D595F58B3A1B9FB841BBD2CA2F80D0EC9F0C02DB6AC1306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b16973f-76ac-4b41-b2b9-2782dbd70d37.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6b16973f-76ac-4b41-b2b9-2782dbd70d37.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 60ae10fc79a334a57390f701ecae574a7433cc9428d29cc7ca1971d57c6a79dd
MD5 e5163e4d8fbce777e2d9aeb549523f4b
SHA1 5c6908e7c2765d29c8f345ec62795b7a90f49cb6
SHA512 c7f4cef17f4fddd7937eec8ef5fc5dafc996f41a30e8f83ccfd90d54e5e5a009ade238f2a98f2d294c7b1f3e0c05def1ddf6709cbb8ef2c8b9192203be970d92
TLSH
T1F741F85CAAFA1158B3B76F569BF6A86E447F7D372E0AD46D10010E4F0A62B40C872737
MD5 SHA1 SHA512 TLSH

Submit Download

Fakepay.jar.crdownload

Path C:\Users\Admin\Downloads\Fakepay.jar.crdownload
Size 7.8MB
SHA256 afd6aa4c10a70772c9bab91cb3ba5c6a6fb9220348f46334391f9f8b07bcf748
MD5 593f7c57f1fa90244730701592d4b0aa
SHA1 bc32d42ab4828d5c0dd7cd1e89eb842469f4f56d
SHA512 90cf5e22b72a137efb47e3e92a07505736785bd441b27b163fc9e686f90dbde795df181329675ac47023c364af34802ac6b6dff651aa4c994b7ae926af178b4e
SSDEEP 196608:o9iyfxjj2QlFjyzAcNeVaqUA0i6hLtPGYyALAo7gyjVA:AiWp/FgAfsKCtGYjLGyO
TLSH
T1608633721BEC5AD6A4707573CB2578B9397C6B136063BCADB321CCA126894E2EF20754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kryptonclient.jar.crdownload

Path C:\Users\Admin\Downloads\kryptonclient.jar.crdownload
Size 12.8MB
SHA256 0807bbceb5b347cc5952854fb9a0574189ab86320d5b21bb55fa8d3439b92159
MD5 8f5893b0903aefd4814d0f6b4a000d38
SHA1 de49eeddc51d0aca875ebe37a09cd4b682fcdef4
SHA512 707103e37b9c6853e588c18f48b74bd6fedea34912a28d729e560650106d3b3038e32b44968078b9f1c491a10ba58ca7350d47bc5cb83f56f56e927a68d7f1a7
SSDEEP 196608:W9iyfxjj2QlFjyzAcNeVaqUA0i6hLtPGYyALAo7gyjVgM4/op5FaucFuZPxPIx83:SiWp/FgAfsKCtGYjLGy14gp53nbMk/
TLSH
T189D633222FA8911F74B0B937DF11756938AC7F0670277EAD76298981F389DC29F25321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4124-253-0x0000019262030000-0x0000019262031000-memory.dmp

Download

memory/4124-272-0x0000019262030000-0x0000019262031000-memory.dmp

Download

memory/5064-244-0x000001DB84D30000-0x000001DB84D31000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads