hxxps://github[.]com/DeadShot208/Dupe-for-DonutSMP

Analysis

user interaction
yes
max time kernel
40s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 03:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/DeadShot208/Dupe-for-DonutSMP
Sample260712-dxaq4sew21

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
95	raw.githubusercontent.com
96	raw.githubusercontent.com
97	raw.githubusercontent.com
98	raw.githubusercontent.com
99	raw.githubusercontent.com
94	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1704	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283001758478676"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{9F4D362A-FC22-48B7-84E7-A1A6F68FC14C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 4768	972	msedge.exe	85
PID 972 wrote to memory of 2224	972	msedge.exe	86
PID 972 wrote to memory of 1704	972	msedge.exe	87
PID 972 wrote to memory of 2224	972	msedge.exe	86
PID 972 wrote to memory of 2224	972	msedge.exe	86
PID 972 wrote to memory of 4760	972	msedge.exe	88
PID 972 wrote to memory of 4760	972	msedge.exe	88
PID 972 wrote to memory of 3016	972	msedge.exe	90
PID 972 wrote to memory of 3016	972	msedge.exe	90
PID 972 wrote to memory of 3016	972	msedge.exe	90
PID 972 wrote to memory of 3492	972	msedge.exe	91
PID 972 wrote to memory of 3492	972	msedge.exe	91
PID 972 wrote to memory of 3492	972	msedge.exe	91
PID 972 wrote to memory of 2812	972	msedge.exe	92
PID 972 wrote to memory of 752	972	msedge.exe	93
PID 972 wrote to memory of 2812	972	msedge.exe	92
PID 972 wrote to memory of 2812	972	msedge.exe	92
PID 972 wrote to memory of 752	972	msedge.exe	93
PID 972 wrote to memory of 752	972	msedge.exe	93
PID 972 wrote to memory of 3140	972	msedge.exe	97
PID 972 wrote to memory of 3140	972	msedge.exe	97
PID 972 wrote to memory of 1680	972	msedge.exe	98
PID 972 wrote to memory of 1680	972	msedge.exe	98
PID 972 wrote to memory of 1816	972	msedge.exe	100
PID 972 wrote to memory of 2280	972	msedge.exe	103
PID 972 wrote to memory of 2280	972	msedge.exe	103
PID 972 wrote to memory of 5072	972	msedge.exe	102
PID 972 wrote to memory of 2280	972	msedge.exe	103
PID 972 wrote to memory of 5072	972	msedge.exe	102
PID 972 wrote to memory of 4488	972	msedge.exe	104
PID 972 wrote to memory of 2692	972	msedge.exe	105
PID 972 wrote to memory of 4100	972	msedge.exe	107
PID 972 wrote to memory of 4564	972	msedge.exe	108
PID 972 wrote to memory of 4196	972	msedge.exe	109
PID 972 wrote to memory of 4488	972	msedge.exe	110
PID 972 wrote to memory of 3896	972	msedge.exe	119
PID 972 wrote to memory of 4856	972	msedge.exe	120
PID 972 wrote to memory of 4672	972	msedge.exe	121
PID 972 wrote to memory of 3248	972	msedge.exe	123
PID 972 wrote to memory of 2088	972	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/DeadShot208/Dupe-for-DonutSMP
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffc0125c188,0x7ffc0125c194,0x7ffc0125c1a0
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1924,i,17127163847543394079,4952554360992425463,262144 --field-trial-handle=2272,i,5035944670179874577,9190851729103802583,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,12997466479197262126,3243942641695701992,524288 --field-trial-handle=2272,i,5035944670179874577,9190851729103802583,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,16202652532581987224,13926264460702993050,524288 --field-trial-handle=2272,i,5035944670179874577,9190851729103802583,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,16645925774780107274,2842072787588033543,2097152 --field-trial-handle=2272,i,5035944670179874577,9190851729103802583,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,3688049906774709036,15303034712201335598,2097152 --field-trial-handle=2272,i,5035944670179874577,9190851729103802583,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,16029053594580223979,17945189060755636540,2097152 --field-trial-handle=2272,i,5035944670179874577,9190851729103802583,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,11362202452823808469,16715366389499954862,2097152 --field-trial-handle=2272,i,5035944670179874577,9190851729103802583,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,13818471299804560061,7338363855435345778,524288 --field-trial-handle=2272,i,5035944670179874577,9190851729103802583,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,4751148978588823238,3422719852482689283,524288 --field-trial-handle=2272,i,5035944670179874577,9190851729103802583,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,1281285083737474010,2752384251306026898,524288 --field-trial-handle=2272,i,5035944670179874577,9190851729103802583,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,1281285083737474010,2752384251306026898,524288 --field-trial-handle=2272,i,5035944670179874577,9190851729103802583,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,1846490356454020797,17927253854646678213,524288 --field-trial-handle=2272,i,5035944670179874577,9190851729103802583,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6340,i,10862030874709070326,5586160694282201647,2097152 --field-trial-handle=2272,i,5035944670179874577,9190851729103802583,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,11817928616565175918,10659731917534206844,524288 --field-trial-handle=2272,i,5035944670179874577,9190851729103802583,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\DonutSmpDupe1.21.11.jar"
  2⤵
  PID:2692
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\DonutSmpDupe1.21.11.jar"
  2⤵
  PID:4100
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\DonutSmpDupe1.21.11.jar"
  2⤵
  PID:4564
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\DonutSmpDupe1.21.11.jar"
  2⤵
  PID:4196
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\DonutSmpDupe1.21.11.jar"
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,4920345961676590890,17848911014806909072,524288 --field-trial-handle=2272,i,5035944670179874577,9190851729103802583,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,7646373798328605969,10007919721979976179,524288 --field-trial-handle=2272,i,5035944670179874577,9190851729103802583,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,1401583657760897611,3431801303267612551,524288 --field-trial-handle=2272,i,5035944670179874577,9190851729103802583,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\DonutSmpDupe1.21.11.jar"
  2⤵
  PID:3248
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\DonutSmpDupe1.21.11.jar"
  2⤵
  PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 e1f913345714f276748e8331f388630a8152fddc7a167b3ca4436310765cae39
MD5 1c4ff1ace49a1967cf8a9573e6f20d1e
SHA1 c679435b56046c15b9a2fc8b1c36eed2824288e5
SHA512 c3399c1b0519cbf124ff31866146e88e95fbcca0eb8a3459e01066d53db60c0852b74ca476e75d09250adddeb71e4f4a74d348a7bbea7bb4a524fcda2e3f77ff
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 c6036f005c04437cb9b55ed86f543c3bb1b8ef27b05461e2b59e0787e314c5c2
MD5 87173722649a7099dae8b1bf32b2c2a5
SHA1 1ddf0bbbd6d67b3aa89446449cf0d5b12e0baf64
SHA512 92b29311c59dd7e708716cda78354847e07d847766a2fb74be14e6613b36b78ab0178ed864940da27bec936b459f0f2bc2a2460ff49a47b09bc8078081ab6d5b
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 59792940d2a6e520f757bfaba948e7970b2b63030bd3affe2a6ff27e20b9d9ce
MD5 5b98bace9da67bbc2e1cd4af1dc5ea4a
SHA1 3c2f6629d214e19c79cf4d57a7b37d001e8c3bfb
SHA512 8f321a7413c0c0896256445327cce21e8bc61869af90c3342d1996ec90d7bb5df313541c5e73007b64f334d8405f742a6d8aab42e69ba5a9af75d868564be386
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 6ebc55cfdc073e59b8d3a2d6b832853077b950f8aff8b3c58137b778a2cb8693
MD5 2d46a6ad8095c4801af55b4a19951c76
SHA1 6f68e34632661d00c0dcbed8b46856f353d1ed3a
SHA512 4f42bb0bc7f05f1762645922d9e20c0408b409b81cb28de145909b0c89af636731a29563cb37e0af5ec3911af35ef828ef389da534292d1ad6aca73810a536a6
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 cb9000acfe0f36e6da9cb8e950436ba1b6824ac15f8821afbc209815b6210c7b
MD5 5138e9eea736d596d19a22f53c7ecab0
SHA1 28cc123667a0780c7b9ef4438058bdbe122957c0
SHA512 b6daba946c5a9f913d712b58afaf1976afe84b28ac36536dc831073e6492ca7b667cb35e5351ca360a245829a14ae5fc80b1a5a6ab6ad7b25190dd2d29396a67
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 9317262ba2f9256bac3ae1230f9b6284e17d56d551cd0973476bb08488bcc122
MD5 8c8162c1d77042047efbdd80053f79dd
SHA1 fe0447c78410caa2ba7a778a7d41110053d3a92c
SHA512 c56c53fc7902c56552b4c12a961ec68ccca05a64ec65546c95c7c30e358ae70f53d1244e45afab18815fe6ac36ae20de6a32e8022ad5beea30e0168326f50413
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 fcbf13b96d3b33bf5fcb56f3c408a54e6a4bde801bd59307c6a11a2f10e38f87
MD5 852b6e0f1d5733c12cffbd022b5d2b29
SHA1 f807071bf796801e54577e31672b389c3f2d6f0c
SHA512 201c5b4a0c0adbe87c9862cf39d967330c0c86f2d5806c188d7026c91377ccb949e403032b4edbdb97ae3d24d16b57564d6ea58aa8f7a452523059be62ca52fe
SSDEEP 96:FVRpCLfTQ6fohl4A72JnEEclOnVM4HRLT4:FVKLLdf+4AS04C4HZT4
TLSH
T149C14BB04B9BCEF6FB51B13544D222633633AEEEFC335EA65ED246341695BA1B4C5020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58a033.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a033.TMP
Size 3KB
SHA256 329cec1bd5441ac8058a82093df50d9546ea7b6b5968f59d850183c7b7c81009
MD5 6b9532815164fa6315f2f54c790befe1
SHA1 e8513092a9f674bd51c8e7ea4b9e5131095caff5
SHA512 6355b10e7a2cfee8ca7cf118cb859ed6611c30f68792d5fecc1c2526241f0a8684fa14f1c7e97c7f058d1c7c56a6b1f302c31d7a02515037c4e425f49b62f309
TLSH
T1BA714CB04EDB0563FB60803168E333667731B7FAFC175E9902E24B302795762F45A024
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 55c507908d4c3cd60ea79d796606408cef401d30cbaf95489748773d2f388275
MD5 0f39db437211c5ee5a5e3eb2f297655d
SHA1 4df5a19758018b350fa798713329a3115f45bdff
SHA512 b75812c352207db76bb4c3ac8e81dc16f479fa66a2f919cb4f30ab4c9f69ffc7b665c1508d4e6f4c11afad88edf5e01179aa99dcd6b08bb7dd45fb29fc2c257d
SSDEEP 192:sxZkRUyM/jK1Ml8M9L/fnstbZDIdp9gBHW6+WNY8c/YIAFBbIgrJ:sxZk21L/fns1ZcWHb4/k9
TLSH
T15552E8166A3459B7CDDBD209F955BBA3D6F50473A3940D84AAFCCA0C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 83e70586f741245eda4279c233923ecb81c98a7bcdc5120137c089335a9a42a9
MD5 4fe104639b61ebc95e8a4643eea3a9ce
SHA1 59398bf61757c71ddcd6291231cff4c6cbe0481c
SHA512 4028dea116c47ab9e6215743b81110fe1c4f78da6842169ac80019cc76eff7401485cc5abba86df57bb05d335f0f2a69a541a6c4546d9bfb98214de8bf486a4e
SSDEEP 768:NBsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9aroXfhs:NBsqxXlWvJD6Tu1ja54LAs9RXa
TLSH
T126D20B3B694CCB7E4F840E5DEC266FD66ED801CBA6988D5447FA880C02CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 866df645eff0abd3dabf20d2b4a812d1ce4c9606402a929504db179c647f3fe9
MD5 a7bbfeff387b245c591ebf5c699f43db
SHA1 4737e652d90c43563d3ba11ed20de601bf94ec5c
SHA512 0e3ba09ac9dcca39de40238a0fd778b373266a6c65793bf58b128b3a234f4efe3492810c123f9cf6cf3a4229518a53b973b5e0b7ca1cf0aaa95eb38e75dfed75
SSDEEP 96:KYbaKYIK+P6Ko8uutGKuIRJKKqQaCMwKZ2d:ExZBdPxzW
TLSH
T1ACE14C52713B821238BD690CA27696378E8373A77518A56F7FB870720E66E110DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e8f29d0f96ab3b1b66237d384f173f6e7d7a50a0deb43b9acd6ab7bff22738fd
MD5 c308da5c02fc480309436c4457ce3207
SHA1 e75aaaf9d88f6abb79d38802b3af4c26aa7804e0
SHA512 dce83aa01574d7ef49fa84f0e0d4086c11fcdcf59bd328dca127caabf8fa40cffd53c097f15ed9b3c886aa4a7221a8f362d596e35f44a5cd5c2d4d74ab21d6ac
SSDEEP 384:ltNn/s3n9SfsNmAF4CrbrIVVRNVOK+t9F4+OObjI9G6w79f:lj+9UO4Cs7HVOKs9S+29M9f
TLSH
T188928D36AD284C775DA34559F58B36278FF8617B97C52E80D1DCAF0C02CFAAC531681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d6182883b318369059794fd27d2f6cac003dbc45a96be75346b08e7f08e5f4a3
MD5 e788b7b527d1fc76f3d0e87196e74007
SHA1 2894eaf3b004c6d4927c74ed715b0f314d9d2b67
SHA512 a2bac2be2756e5ba9c1a7a03a5a0c492ef9b4301d39a1b90fd6d325580602496f32d02e65d00761222ab7c54bddbd42e5aa028cc9a28095e1a1fd4043ba6d300
SSDEEP 384:ltNn/s3n9S5sNmAF4Crb9IVVRNVOK+t9F4+OObjI9G6w79f:lj+9CO4Cm7HVOKs9S+29M9f
TLSH
T1B0927D36AD384C775DA34559F58B362B8FF8606B97C52E80D1DDAF0C02CFAAC531681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5b8e3fbec0019aeadfba72c0b79049f94d72a7f6b715e14210f6d13d6b83f864
MD5 aab09f7aa2d44aad677087cbc6d222f2
SHA1 2d1886cbf59b03aedb7a067d92482ecc32df2e1b
SHA512 a95d6915ab8815c3e8c85326d83e7c2288818fb5a3b65c6e58302dedd7ca0f6f361ff7ef09f9bb2c2aa2358a63742a63ce8bba30093e109f82a2e37ef95ba92f
SSDEEP 192:tONc6JkRtQmiUyhHW+RNVOmSY+y9h3fReU6:tONc6UrGW+RNVOK+G0U6
TLSH
T10B02D935AD381C7B9EF66E0AB48B27175FA5203BEA856F84D6D81F0C01D765C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 60d58087b9e09e7e502140fd05061c9682eaaeeb8da8f97847c8d5305705a25c
MD5 42af33609fa1d966ee4ec22a61a2a727
SHA1 a7be542815c07bd7df32edcdc2993b9bcb7c4142
SHA512 90d2d8358e97965180238507b8511a0e3e2258b0d274a7852dedd8e854718a7267a0737615fbd8b0a521d21aace98c48a9fc08b7f4ca56e059fbd3434902da25
SSDEEP 384:OtNn/s3n9S8sNmRF4CrbaIVVRNVOK+t9F4+OObjI9G6w79f:Oj+9Ll4Cz7HVOKs9S+29M9f
TLSH
T159928D366D284D779DE34555F58B36278FF4606B97C52E80D1DCAF0C02CFAAC531681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 eb1c9a1081cecc39747803d85208f2a19914e0964523175650e110d0b074afdf
MD5 26fc5a3e3ba9c0ac9c9b54af5b5a4077
SHA1 0c9774d7634f4d8ec02e6956dc9d37595f000bdc
SHA512 12528f759f0c69f36a715ebf060789080380438572362d61b2abd3c13f75ace533d20fba5baa3e7d88351883d5e4a6797709e71e1897766c65e9aee308d8c9c6
SSDEEP 192:HON/6JkRAQmiUylHn+RNVOmSY+y6l9nFyVcsquegU6:HON/6UA8n+RNVOK+t9FV+U6
TLSH
T154120936AD385C7B5EE26945F58732178FA55127EB896FC0D1DC1F0C02DFA9C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cc1c082-5b4c-4191-8bc6-b9520664e97c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4cc1c082-5b4c-4191-8bc6-b9520664e97c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 eac5e745d9ff55b15784ad9e0a02fd08380625cf994144b6ae082533a9554532
MD5 70528c44c059595df0015966a71bc3a9
SHA1 2d338dc15597d0e138fbd5c8f89933de42be015e
SHA512 fc4c9ce613e7576f7a059a3ea2294bee48ce71b1f0da5b61e87e2f09f403c4bd43f374ca6dd1697882dea74ceaf3dbb4372bd15734947e2996b999c6654d2de6
TLSH
T17841295CB7FA1148B3B76E56ABF6A86D487FB8772E06D05E00110D8F0B63A40D8A1733
MD5 SHA1 SHA512 TLSH

Submit Download

DonutSmpDupe1.21.11.jar

Path C:\Users\Admin\Downloads\DonutSmpDupe1.21.11.jar
Size 15KB
SHA256 ebc05ba1ce59d9c64cacab863e33e96a54e778444f8a45ca978e693e9836f3c4
MD5 df149dc7f163a9f18bd26e742bbebdd4
SHA1 c17a625c00615d9e56bfb890a746cc4c943edd0f
SHA512 98b213e1fc20793f2f0b8e90b08838e94ccedb99c6ea244487ff150c8fe46ed5e17e5f9432f53622e36e44f1c8c1d81d153344f7ea36eb774232aff46dd8f4c4
SSDEEP 384:eE2PU7kWNsglLWxGl5ZjlidYW31+1gpyRg6yle5++fJ:aPU7jN353idR310T3+8f
TLSH
T1D372D06492FB2781E6884C372C421152BC47932BF9C4B9375DA6337650F7A332D8AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2088-510-0x000001BA5F6D0000-0x000001BA5FF80000-memory.dmp

Download

memory/2088-509-0x000001BA5DE40000-0x000001BA5DE41000-memory.dmp

Download

memory/2692-407-0x000001D39A200000-0x000001D39A201000-memory.dmp

Download

memory/3248-500-0x000002E7337E0000-0x000002E7337E1000-memory.dmp

Download

memory/3248-501-0x000002E735070000-0x000002E735920000-memory.dmp

Download

memory/4100-406-0x000002793C930000-0x000002793C931000-memory.dmp

Download

memory/4196-448-0x000002199BA80000-0x000002199BA81000-memory.dmp

Download

memory/4488-456-0x000001DD75EE0000-0x000001DD75EE1000-memory.dmp

Download

memory/4564-413-0x000001F656EF0000-0x000001F656EF1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads