eternity | 5c7f5485e4a2a18e91dcf413a5f14c36afb018f22d64b65066162cd0e3fc6d5d

Resubmissions

12-06-2023 17:44

230612-wbky3adb79 10

Analysis

max time kernel
601s
max time network
509s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2023 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Eternity.exe
Size

40.7MB
MD5

909e2b616e00a2bc02bdffc997579410
SHA1

5844639727922d3a680d908f7d413363b998d17c
SHA256

cdb04f1b435968dacea47f4a28fff8c0612ffbac9b8df2da01014760d71a297f
SHA512

ccdf71d58e0397f8201a7a3e7014520184ebba841143795e41793da8def0d5d077f4fcca2390b3f7689e5f99dacfa0f86904d66d47f6e77f5c0e1cba39bda6a5
SSDEEP

786432:jzvsyBy7Mu30RxS9MQo+hc3XivKvWN0w4xng7+2MD4sLh:UyCMrzwag7+2MkW

Score

10^/10

eternity growtopia stealer

Malware Config

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
Loads dropped DLL 1 IoCs

Processes:

Eternity.exe

pid process

3772 Eternity.exe

pid	process
3772	Eternity.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\130e0950-8b80-4eef-8446-71eed9668032.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230612174604.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
5056	msedge.exe
5056	msedge.exe
1492	msedge.exe
1492	msedge.exe
3904	msedge.exe
3904	msedge.exe
5444	msedge.exe
5444	msedge.exe
1392	msedge.exe
1392	msedge.exe
2164	identity_helper.exe
2164	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

Processes:

msedge.exe

pid	process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Eternity.exe

description pid process

Token: SeDebugPrivilege 3772 Eternity.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Eternity.exemsedge.exe

pid process

3772 Eternity.exe
1392 msedge.exe
1392 msedge.exe
1392 msedge.exe

description	pid	process
Token: SeDebugPrivilege	3772	Eternity.exe

pid	process
3772	Eternity.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Eternity.exemsedge.exemsedge.exemsedge.exemsedge.exe

description	pid	process	target process
PID 3772 wrote to memory of 1392	3772	Eternity.exe	msedge.exe
PID 3772 wrote to memory of 1392	3772	Eternity.exe	msedge.exe
PID 3772 wrote to memory of 3588	3772	Eternity.exe	msedge.exe
PID 3772 wrote to memory of 3588	3772	Eternity.exe	msedge.exe
PID 3588 wrote to memory of 2136	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 2136	3588	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2984	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2984	1392	msedge.exe	msedge.exe
PID 3772 wrote to memory of 3988	3772	Eternity.exe	msedge.exe
PID 3772 wrote to memory of 3988	3772	Eternity.exe	msedge.exe
PID 3988 wrote to memory of 2572	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 2572	3988	msedge.exe	msedge.exe
PID 3772 wrote to memory of 3720	3772	Eternity.exe	msedge.exe
PID 3772 wrote to memory of 3720	3772	Eternity.exe	msedge.exe
PID 3720 wrote to memory of 3020	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3020	3720	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1892	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 3904	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 3904	1392	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4172	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4172	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4172	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4172	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4172	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4172	3588	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\Eternity.exe
"C:\Users\Admin\AppData\Local\Temp\Eternity.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://eternitypr.net/register
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc470d46f8,0x7ffc470d4708,0x7ffc470d4718
    3⤵
    PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,6128990286441804779,2100072944682389380,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,6128990286441804779,2100072944682389380,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://eternitypr.net/register
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc470d46f8,0x7ffc470d4708,0x7ffc470d4718
    3⤵
    PID:2984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,3840171089744463907,8230289238613654607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,3840171089744463907,8230289238613654607,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
    3⤵
    PID:1892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,3840171089744463907,8230289238613654607,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3840171089744463907,8230289238613654607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
    3⤵
    PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3840171089744463907,8230289238613654607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
    3⤵
    PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3840171089744463907,8230289238613654607,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
    3⤵
    PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3840171089744463907,8230289238613654607,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3840171089744463907,8230289238613654607,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4432 /prefetch:1
    3⤵
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3840171089744463907,8230289238613654607,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3840171089744463907,8230289238613654607,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
    3⤵
    PID:5672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3840171089744463907,8230289238613654607,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
    3⤵
    PID:6172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3840171089744463907,8230289238613654607,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
    3⤵
    PID:6212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3840171089744463907,8230289238613654607,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
    3⤵
    PID:6256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3840171089744463907,8230289238613654607,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
    3⤵
    PID:6284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3840171089744463907,8230289238613654607,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
    3⤵
    PID:6376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3840171089744463907,8230289238613654607,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
    3⤵
    PID:6448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3840171089744463907,8230289238613654607,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:1
    3⤵
    PID:6692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3840171089744463907,8230289238613654607,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
    3⤵
    PID:5348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3840171089744463907,8230289238613654607,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7416 /prefetch:1
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,3840171089744463907,8230289238613654607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 /prefetch:8
    3⤵
    PID:6876
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:1756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6cc8d5460,0x7ff6cc8d5470,0x7ff6cc8d5480
      4⤵
      PID:6980
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,3840171089744463907,8230289238613654607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3840171089744463907,8230289238613654607,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7820 /prefetch:1
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3840171089744463907,8230289238613654607,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
    3⤵
    PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://eternitypr.net/register
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc470d46f8,0x7ffc470d4708,0x7ffc470d4718
    3⤵
    PID:2572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,5891799275062401730,1589029803778570842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5891799275062401730,1589029803778570842,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
    3⤵
    PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://eternitypr.net/register
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc470d46f8,0x7ffc470d4708,0x7ffc470d4718
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,1740564230571781734,10519612083462660960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,1740564230571781734,10519612083462660960,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
    3⤵
    PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://eternitypr.net/register
  2⤵
  PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffc470d46f8,0x7ffc470d4708,0x7ffc470d4718
    3⤵
    PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://eternitypr.net/register
  2⤵
  PID:516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc470d46f8,0x7ffc470d4708,0x7ffc470d4718
    3⤵
    PID:464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
cc4f799ac6cc9ce4cad89c96ea35a320

SHA1
76d1077f00f0d6b42b51f76cbdc9cff627c772e4

SHA256
4063773d71ba0e6428ea974c2fc847264788eca591a20ff525747a884bf43107

SHA512
fcf8c26b5a204eb9145c3eee6d576240faaf8cab22497c93828234ea9d3670a076cf2462565a2e982cca6c08bfcabf9c8bad5d3835e7bfc3d639d17130bc1706

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
408B

MD5
959c77160db99f9bb90f254b69215e6b

SHA1
fdfc3f41688f583e9d74495ce48bcdc4017e9b93

SHA256
398134b20f28fd6b8e2fff0c86a2a33b4b45ab67cffd0b23044e5cf247d0e25d

SHA512
9a3dc951f1dcf295db0920d87702a9baf426ef7b00b7ef821ea242680c0dd7e57515257364c7e300a2c8ac6ecfc3f18c90376b7f4f4e4d23f24eee621e026274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a10efe23009825eadc90c37a38d9401

SHA1
fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0

SHA256
05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5

SHA512
89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a10efe23009825eadc90c37a38d9401

SHA1
fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0

SHA256
05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5

SHA512
89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a10efe23009825eadc90c37a38d9401

SHA1
fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0

SHA256
05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5

SHA512
89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a10efe23009825eadc90c37a38d9401

SHA1
fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0

SHA256
05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5

SHA512
89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
346523c97beca4c14d426933fa58d2c3

SHA1
d8783881294128fdce68f90bfeda17d0311959f8

SHA256
7d76755ea296a01eb36e15d72658cfc5364e0443252a089cd1d89eb55fc31a3b

SHA512
5236637cbdb21ff6aaba1db0d5453648c2d1b42c3a89dfbb0ea510fd4555e2455c078c2b5a78755d458bcc0cc2dcbdc6f1b28dde0e25172059de00effce29338

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe575350.TMP

Filesize
48B

MD5
58d7a5a2add9eb8ae8df2b49df3ba84e

SHA1
d8894d24ff5082477e56d4a96304bad23f7c40d1

SHA256
2ad3eb72f5e96f7cabfdd122e6011b74bfe033a7218ccb211268537d596c1db3

SHA512
496c189a24f64f9b7500466d306261d3f29092c794c310bf177647a60c385fc86f62aa037c8e803af4490dd1adfc8366e9f35ad5d5fa479b2f83383c20c7b246

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
6b5b5d9122444efc837fb4361adcd4ad

SHA1
b4aad8fefb4e35f075570b0b5351a3e5172d704c

SHA256
60d4b13990a390449f7eb30d8403eed6bc9302f4d4a7839e0a85de1dacaac352

SHA512
67bef504c320b575f71bc7977d5d50c3dc16196d56f560f5565660886a4da14f352e23678fcb3ecc3222f2e63d8f33bdb60e69ec667874d18ae7fe3a63f8e243

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
554B

MD5
a20ea94e62af6aba54e7a805051fabff

SHA1
1b65c9e71c4671fbc046f8585a46b789a8bdfdfc

SHA256
3315384d9c4cc7601292b0ca54d23e2a808debf08fca15a25c7ba7fb3a2a37bf

SHA512
50f1cfe91a8d753e41cf4e7f5f95068241ef804f8f187be80354c6215c3ef157e45bb9f2f4981cc0323b4298f05fd343e65390510bbceff39034a3e4810680ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
03504ff5ea5c90c32951cf2b4149c099

SHA1
4f2329ed7ad5a6dadc6a3bc51e670ed9cc1a337f

SHA256
262365c204b8f1d23c9b896fdaf877fd009d4d92947156b18757d48fe2fa8e9c

SHA512
81187cf69a6aaea5c43d29b53844aba3dd79b4da19e380cbfd0f6fc968c57865ed89640e56f990bbdc2e99f48e6a736336e9c677839fde3b32e34e6b0dc374a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d08b0aaffb535b6e038c237f1bb53ba2

SHA1
e68dfa3ffb6d0f4c4e2d180f550ebe16b5073452

SHA256
c8fe3dc1a5c70a9cfef6546410a39a392432518ca11b94c3ed015687600742b7

SHA512
9e3160cc4172bc7d516c446c427e4ca0c80a3606f60966ed5a1878a155e3e9dbfe3a5f02383aa2189253da9cd70220bebfd28af13becd8e918b12b09c6a9a176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
88daad44026d3bd5b60e7d60a618f995

SHA1
e5974dc69250663b27641e98e113b5e80548dc9e

SHA256
943aa04adcdf2762b988456c4a9a201b223d71c41ce0e96cc3760190b4a5f3f1

SHA512
46b0b94b848a9b654db4932ce852e1b385428b9698066ac1debf7bf311456d313f4272619fdb34dcca95ca72e9cee601445940fcb3f3b9a18ca2ba4cbdadad2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5edab6d3ffbeee247ccb4423f929a323

SHA1
a4ad201d149d59392a2a3163bd86ee900e20f3d9

SHA256
460cddb95ea1d9bc8d95d295dd051b49a1436437a91ddec5f131235b2d516933

SHA512
263fa99f03ea1ef381ca19f10fbe0362c1f9c129502dc6b730b076cafcf34b40a70ee8a0ee9446ec9c89c3a2d9855450609ec0f8cf9d0a1b2aebdd12be58d38c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
784a51387993e9aeb34d4ad4ed93ab48

SHA1
1cbf9ea1b6c2ea18c8670f26ebf9c11d7d245bc4

SHA256
567af49b26f4676e8c8ad07b34db13ae7a9e19ba01e6bd1af390a611b44413f8

SHA512
ba34c55cea5840723b16f09f0a790f823a5a65657f8163018cbfcbc3a13c83b1b4b6a1f8ca0fe188c1ba7d78cc9319889235c0f6042a2013755fc6d820e4b9e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
27f3e23fb37f94590beabada194aff27

SHA1
166df244e4dbbd50e8a66fbf1b473f504e34379d

SHA256
d59e5b17616c5623700b86144b984dae1df5fc4bebeb250d14f86f50fa4c1506

SHA512
c1407e19748f7e4a422f4f7ccc9149ba3c3a6e2879b49dcd124776420d797a668d993a1e37db61b96bd62a00148e4917acc32f06a46774e034a5d32f66b658a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
1737f59aa6cb5867b0f67b9ad0f8e9f8

SHA1
63ade0d9f9f8e1c9586ddee45383504145f524ce

SHA256
9218ca6826db20ef780e683d854e847ff696b419a2f83436ab832952acc8182a

SHA512
314ff8871f6d9e3a89b94d80dda59f9d8644fcf710163ff4f5a78f8d42b6dda4abcbf2a0b7c453f0df928a6deaa4336c1db2603953346235f7e51fc0accd1311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
1737f59aa6cb5867b0f67b9ad0f8e9f8

SHA1
63ade0d9f9f8e1c9586ddee45383504145f524ce

SHA256
9218ca6826db20ef780e683d854e847ff696b419a2f83436ab832952acc8182a

SHA512
314ff8871f6d9e3a89b94d80dda59f9d8644fcf710163ff4f5a78f8d42b6dda4abcbf2a0b7c453f0df928a6deaa4336c1db2603953346235f7e51fc0accd1311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
553b6e6a28e510945466e750f18dff21

SHA1
86fcca0b3a4a5a4b1d58273587cabd8a8b321b01

SHA256
fb608157f6235373b5561aee7472c4d53836be42d837771cd1511fcb22f1b7fb

SHA512
cfe04b4ed6d62a743b6db13a2cf6b9002546ed900ce6e18bfad4f6ca3139dc8a67cdf7c0eb0d07e6a550cb2ce86ebac7f281a86a03a3f50ddc4fe9da5f026dd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
3d9723331f670af1e9642246427c71d9

SHA1
b594f45d540db1a03c93b29a7183c652a04581e3

SHA256
bbe90af82c9baaafcd3e5a1a5a8895291f9bb3e3ac99cffc233c612847ee9e37

SHA512
df51d65d43a9038309ef0f61c2fc612a95aa561d62b4dd9471ea618b1b457a492d6849f7c31d459978720c787f794005a042dc35c7c91d875c43b8cfda972619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
3d9723331f670af1e9642246427c71d9

SHA1
b594f45d540db1a03c93b29a7183c652a04581e3

SHA256
bbe90af82c9baaafcd3e5a1a5a8895291f9bb3e3ac99cffc233c612847ee9e37

SHA512
df51d65d43a9038309ef0f61c2fc612a95aa561d62b4dd9471ea618b1b457a492d6849f7c31d459978720c787f794005a042dc35c7c91d875c43b8cfda972619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
fde1b34e06fd4ccb467b72ddf21693cd

SHA1
a631c7ae5ed71e0ffdb837b6fcf25aec6320257f

SHA256
e37bb441d84a6f180111f4359e1c1996faeb8e47f3ddcabbfc58d08e89b000f7

SHA512
96d8c44242b24554ac220dcdf42b3ba083ed8658fb80817ea9dc250d0b76d05a24c5767e0b748fee771a73382922f2394796664ffef95da1ec4fb3806eed6d24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
fde1b34e06fd4ccb467b72ddf21693cd

SHA1
a631c7ae5ed71e0ffdb837b6fcf25aec6320257f

SHA256
e37bb441d84a6f180111f4359e1c1996faeb8e47f3ddcabbfc58d08e89b000f7

SHA512
96d8c44242b24554ac220dcdf42b3ba083ed8658fb80817ea9dc250d0b76d05a24c5767e0b748fee771a73382922f2394796664ffef95da1ec4fb3806eed6d24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
3d9723331f670af1e9642246427c71d9

SHA1
b594f45d540db1a03c93b29a7183c652a04581e3

SHA256
bbe90af82c9baaafcd3e5a1a5a8895291f9bb3e3ac99cffc233c612847ee9e37

SHA512
df51d65d43a9038309ef0f61c2fc612a95aa561d62b4dd9471ea618b1b457a492d6849f7c31d459978720c787f794005a042dc35c7c91d875c43b8cfda972619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
1737f59aa6cb5867b0f67b9ad0f8e9f8

SHA1
63ade0d9f9f8e1c9586ddee45383504145f524ce

SHA256
9218ca6826db20ef780e683d854e847ff696b419a2f83436ab832952acc8182a

SHA512
314ff8871f6d9e3a89b94d80dda59f9d8644fcf710163ff4f5a78f8d42b6dda4abcbf2a0b7c453f0df928a6deaa4336c1db2603953346235f7e51fc0accd1311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
fde1b34e06fd4ccb467b72ddf21693cd

SHA1
a631c7ae5ed71e0ffdb837b6fcf25aec6320257f

SHA256
e37bb441d84a6f180111f4359e1c1996faeb8e47f3ddcabbfc58d08e89b000f7

SHA512
96d8c44242b24554ac220dcdf42b3ba083ed8658fb80817ea9dc250d0b76d05a24c5767e0b748fee771a73382922f2394796664ffef95da1ec4fb3806eed6d24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
0189ccbfd24b7a12697649acbd4ce500

SHA1
3a544d3f291ff81b01409b4633798ace959c1be7

SHA256
c64f91b9eaaf738c9d31a6230cb2ba6bf82c717473503825531515f69a4e69d5

SHA512
b31967572df1f4a50d49e314a6dbaa18261567596cfe78a9beb8fae47b74d371044914af1b5856a2bca78951b9509c516f2547ee26e02443ef8a2c1a01b6d1ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
8ff2b295ba4fefb749894420addd9bc4

SHA1
f5fb30dd0d36b6fd902d1d391af57731f4314245

SHA256
3cac1934e1a4bf20ec6186ed6e497d98b23fa9ea01c61b15ca5b8f2a4f37275d

SHA512
27ba3e141ca30e2f4d2f7183cf2ba0b2ee2501dbb9870a9d4fa21cafa0fa9cf44165d847d83752dc8539e6b20146720001969cf416fc1f13c49f2e5c0a717938

Download Submit
C:\Users\Admin\AppData\Local\Temp\enet_managed_resource\enet-win32-x86.dll

Filesize
39KB

MD5
9ee69aa4f1d58226f40fbc3cb509a7ad

SHA1
eb5313a624cc6da2d9f6207aaa4977039db336ee

SHA256
1f13200b33c50c78d3bed0e05b0369d6379b38660328c5565e5aa40fa408eb48

SHA512
b1c2d72523c1ec874c32f0b26dd4d07467803eb7770e1597abe5040501c3da15f775643be6bc5e550ae3bc01ad49cec4324645543133f8154932e750e909da19

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
94e4b86f47e905dcfb710643ba691d93

SHA1
9abfde30b8778136dff4956bf445ebf9378346bb

SHA256
191c35f0a5bb350fbdea6c3b56e4fd736975301c1cef430667b8441ea9a1322b

SHA512
145ba6c6dffa7a2058994b24820efe8450cabec930346403d06fe6679c68411c4fa62822719cfc58d1b324ec78ce4349924e2ce4b64e19d43206e166287aee17

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
083c6ac5c04dea533a4bf23154f9dd23

SHA1
c6cf0337200e80f622bd43b173301d1bd69b4922

SHA256
275c02880e20decc5055b904f0f57f007460e2706fb9e9690393fee1c995daa9

SHA512
7e63d428d367259030a9e30119e2df30e2fa3af97ab79af78ffefd90a07611d41c1bb205acf25032b5a2ffcfe3509cbefb22ef559742047367b82c52c9df7667

Download Submit
\??\pipe\LOCAL\crashpad_3588_MCSSAXDAEBFPKDLA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_3720_HKUGXXFMANYFBLYC

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_3988_CKLJJJBCAJYUHXUY

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3772-147-0x000000000B8E0000-0x000000000B920000-memory.dmp

Filesize
256KB

Download
memory/3772-162-0x0000000007310000-0x0000000007320000-memory.dmp

Filesize
64KB

Download
memory/3772-146-0x0000000006E20000-0x0000000006E2A000-memory.dmp

Filesize
40KB

Download
memory/3772-133-0x0000000000190000-0x00000000029F0000-memory.dmp

Filesize
40.4MB

Download
memory/3772-153-0x0000000007310000-0x0000000007320000-memory.dmp

Filesize
64KB

Download
memory/3772-154-0x0000000007710000-0x0000000007732000-memory.dmp

Filesize
136KB

Download
memory/3772-359-0x0000000007310000-0x0000000007320000-memory.dmp

Filesize
64KB

Download
memory/3772-145-0x000000000B700000-0x000000000B7AA000-memory.dmp

Filesize
680KB

Download
memory/3772-148-0x0000000007310000-0x0000000007320000-memory.dmp

Filesize
64KB

Download
memory/3772-149-0x000000006EFC0000-0x000000006EFD2000-memory.dmp

Filesize
72KB

Download
memory/3772-281-0x0000000009290000-0x00000000094BB000-memory.dmp

Filesize
2.2MB

Download
memory/3772-152-0x0000000007310000-0x0000000007320000-memory.dmp

Filesize
64KB

Download
memory/3772-144-0x000000000ADE0000-0x000000000ADFA000-memory.dmp

Filesize
104KB

Download
memory/3772-150-0x0000000007310000-0x0000000007320000-memory.dmp

Filesize
64KB

Download
memory/3772-140-0x000000000AC70000-0x000000000AC78000-memory.dmp

Filesize
32KB

Download
memory/3772-151-0x0000000007310000-0x0000000007320000-memory.dmp

Filesize
64KB

Download
memory/3772-139-0x000000000AE30000-0x000000000AF06000-memory.dmp

Filesize
856KB

Download
memory/3772-138-0x000000000ACB0000-0x000000000AD42000-memory.dmp

Filesize
584KB

Download
memory/3772-137-0x000000000B150000-0x000000000B6F4000-memory.dmp

Filesize
5.6MB

Download
memory/3772-136-0x00000000072A0000-0x00000000072A1000-memory.dmp

Filesize
4KB

Download
memory/3772-135-0x0000000007310000-0x0000000007320000-memory.dmp

Filesize
64KB

Download
memory/3772-134-0x0000000007310000-0x0000000007320000-memory.dmp

Filesize
64KB

Download