eternity | hxxps://github[.]com/L3GOGT/Growtopia-Duplicator-Exploit/releases/download/working/GT[.]Duplicator[.]Exploit[.]zip

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2023, 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/L3GOGT/Growtopia-Duplicator-Exploit/releases/download/working/GT.Duplicator.Exploit.zip

Score

10^/10

eternity stealer

Malware Config

Signatures

Detects Eternity stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/2292-103-0x0000000000990000-0x0000000000A76000-memory.dmp	eternity_stealer
behavioral1/files/0x0008000000023128-143.dat	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemFreezer.exe	SystemFreezer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemFreezer.exe	SystemFreezer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemFreezer.exe	SystemFreezer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemFreezer.exe	SystemFreezer.exe

Executes dropped EXE 3 IoCs

pid	Process
3180	dcd.exe
4836	dcd.exe
4836	dcd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
4524	msedge.exe
4524	msedge.exe
4992	identity_helper.exe
4992	identity_helper.exe
1320	msedge.exe
1320	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2292	SystemFreezer.exe
Token: SeDebugPrivilege	5084	SystemFreezer.exe
Token: SeDebugPrivilege	628	SystemFreezer.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 3140	8	msedge.exe	87
PID 8 wrote to memory of 3140	8	msedge.exe	87
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4868	8	msedge.exe	89
PID 8 wrote to memory of 4524	8	msedge.exe	91
PID 8 wrote to memory of 4524	8	msedge.exe	91
PID 8 wrote to memory of 1636	8	msedge.exe	90
PID 8 wrote to memory of 1636	8	msedge.exe	90
PID 8 wrote to memory of 1636	8	msedge.exe	90
PID 8 wrote to memory of 1636	8	msedge.exe	90
PID 8 wrote to memory of 1636	8	msedge.exe	90
PID 8 wrote to memory of 1636	8	msedge.exe	90
PID 8 wrote to memory of 1636	8	msedge.exe	90
PID 8 wrote to memory of 1636	8	msedge.exe	90
PID 8 wrote to memory of 1636	8	msedge.exe	90
PID 8 wrote to memory of 1636	8	msedge.exe	90
PID 8 wrote to memory of 1636	8	msedge.exe	90
PID 8 wrote to memory of 1636	8	msedge.exe	90
PID 8 wrote to memory of 1636	8	msedge.exe	90
PID 8 wrote to memory of 1636	8	msedge.exe	90
PID 8 wrote to memory of 1636	8	msedge.exe	90
PID 8 wrote to memory of 1636	8	msedge.exe	90
PID 8 wrote to memory of 1636	8	msedge.exe	90
PID 8 wrote to memory of 1636	8	msedge.exe	90
PID 8 wrote to memory of 1636	8	msedge.exe	90
PID 8 wrote to memory of 1636	8	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/L3GOGT/Growtopia-Duplicator-Exploit/releases/download/working/GT.Duplicator.Exploit.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ec1946f8,0x7ff8ec194708,0x7ff8ec194718
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,3929024001078929481,17588997358885815400,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,3929024001078929481,17588997358885815400,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,3929024001078929481,17588997358885815400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3929024001078929481,17588997358885815400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3929024001078929481,17588997358885815400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3929024001078929481,17588997358885815400,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3929024001078929481,17588997358885815400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,3929024001078929481,17588997358885815400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,3929024001078929481,17588997358885815400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,3929024001078929481,17588997358885815400,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3929024001078929481,17588997358885815400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,3929024001078929481,17588997358885815400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3929024001078929481,17588997358885815400,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3929024001078929481,17588997358885815400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3929024001078929481,17588997358885815400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,3929024001078929481,17588997358885815400,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3440 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4392

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2168

C:\Users\Admin\AppData\Local\Temp\Temp1_GT.Duplicator.Exploit.zip\GT Duplicator Exploit\SystemFreezer.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_GT.Duplicator.Exploit.zip\GT Duplicator Exploit\SystemFreezer.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:2292
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:3180

C:\Users\Admin\AppData\Local\Temp\Temp1_GT.Duplicator.Exploit.zip\GT Duplicator Exploit\SystemFreezer.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_GT.Duplicator.Exploit.zip\GT Duplicator Exploit\SystemFreezer.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:5084
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:4836

C:\Users\Admin\AppData\Local\Temp\Temp1_GT.Duplicator.Exploit.zip\GT Duplicator Exploit\SystemFreezer.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_GT.Duplicator.Exploit.zip\GT Duplicator Exploit\SystemFreezer.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:628
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8098e008-9e02-4728-bf94-30b8a677882a.tmp

Filesize
10KB

MD5
ac0ca66ac4c91ca3b77783527979b645

SHA1
317c25230f0a90a5ecd27fbac4a5cc38d7dc5c5c

SHA256
6b06c317071768e8c127cfbb5390664a552d273d1357aa523a120bfba1a6c71f

SHA512
07b45f6509b702bc334a4423ea8f1e718e2e1d6040917088e6b96a9a57f04801a9d221fcefa173976dcda9bc575ca08fb44f82ade528ddf67daffd6be1aebebc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
208a234643c411e1b919e904ee20115e

SHA1
400b6e6860953f981bfe4716c345b797ed5b2b5b

SHA256
af80020ae43388bbd3db31c75aade369d489a30a933574dea19163e094d5f458

SHA512
2779b96325234c836cbb91820ee332ed56c15b534ec0c7770b322a5c03849ec3ee67b0ec7978e1fab563eeed1cea96f5155d7b942702555d9352ff6711a548d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
265B

MD5
f5cd008cf465804d0e6f39a8d81f9a2d

SHA1
6b2907356472ed4a719e5675cc08969f30adc855

SHA256
fcea95cc39dc6c2a925f5aed739dbedaa405ee4ce127f535fcf1c751b2b8fb5d

SHA512
dc97034546a4c94bdaa6f644b5cfd1e477209de9a03a5b02a360c254a406c1d647d6f90860f385e27387b35631c41f0886cb543ede9116436941b9af6cd3285d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6f530f1f11bf69ff10ee37e799208bc0

SHA1
1f90bb1505616020ca14368bc1162d5e6d68a871

SHA256
fa7fde1d2ddd376a9a65addbc35ab23fe71e8f4f06fe24d9b7a9bd151d8670f5

SHA512
f6afebacfd754739f1e0486fd1666d2b40e2706b6fab96d83cd786c17ca57f86206833e3df2e7a5caafb2aea7f7386274001956a7079bd18d6b50b4593a92d19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7199eab038c28907bacfecd816d387ee

SHA1
efc8cb53429081ecca1d4284e2ee2a2db6e69c71

SHA256
4c27360601cfcc7cde3522dd490c4878802c10be7587f31dc616483b74227067

SHA512
07c23132e7aed82c0d736f22436a63b06f20e72fd4570ae78d037dcce31358dad205797593f6c008a30e1275332201c191d8064a2857a78e7824dc85d8c6685a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5a6206a3489650bf4a9c3ce44a428126

SHA1
3137a909ef8b098687ec536c57caa1bacc77224b

SHA256
0a9e623c6df237c02a585539bffb8249de48949c6d074fe0aaf43063731a3e28

SHA512
980da83c3142bf08433ec1770a2ec5f5560daf3ee680466f89beae8290e921c0db677489daad055fbc1f196388f8bc4f60e050600381f860b06d330062440a78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3360cb9430c3e9491d08df94ce7aa18b

SHA1
7dfc1554ec47ab9a472d47e77baf064a371860b7

SHA256
9ddf1048c52129818182bf4d8150ac4c3e3845d08d6dce9b1350256216ac33fe

SHA512
ebca653f018925b6333923272f1f0c6aea41c4c08619c7e2a1d401b7cfa317b61f9516db8b81cba5c3d060659f3ab7f2c71205f9a782d98c9b6aec2171b43e3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemFreezer.exe

Filesize
884KB

MD5
c535be7d5fca25b986c17ff8dda9d482

SHA1
99199849ab5140e0df64083ae70c9b65265308f7

SHA256
07cc4f727bac2537a45421540107751df24bb736d6e471d90f84e73366e111e0

SHA512
c7ac6268ce848f7137e9c31407abbad528f0129d1c436c831b79ca30ec304ebd7da0d94fe70128be3c3c383edb85b59c9a546e8e64e6cec11be414c7bd4159c2

Download Submit
C:\Users\Admin\Downloads\GT.Duplicator.Exploit.zip

Filesize
607KB

MD5
19f3b40baf7953f2068ec3f148a2c1aa

SHA1
d7c9d9307d317177d7b8f394b838e57f0157bbc5

SHA256
3064f41531487ee3b9205367940d50ab150775008c1ff13b92069cbbbb828e1f

SHA512
364b8b24cef388466d5365d7a6a738082770e4be648d1de3745df346ebabcf838749f16dfe647133550e5922c90ee5fe464e3528691a7e05bdcc55a379bde6c0

Download Submit
memory/628-181-0x00007FF8D8270000-0x00007FF8D8D31000-memory.dmp

Filesize
10.8MB

Download
memory/628-176-0x000000001B980000-0x000000001B990000-memory.dmp

Filesize
64KB

Download
memory/628-175-0x000000001B980000-0x000000001B990000-memory.dmp

Filesize
64KB

Download
memory/628-174-0x000000001B980000-0x000000001B990000-memory.dmp

Filesize
64KB

Download
memory/628-173-0x0000000001440000-0x0000000001441000-memory.dmp

Filesize
4KB

Download
memory/628-172-0x00007FF8D8270000-0x00007FF8D8D31000-memory.dmp

Filesize
10.8MB

Download
memory/2292-111-0x000000001B770000-0x000000001B780000-memory.dmp

Filesize
64KB

Download
memory/2292-105-0x0000000002B60000-0x0000000002BB0000-memory.dmp

Filesize
320KB

Download
memory/2292-106-0x0000000001260000-0x0000000001261000-memory.dmp

Filesize
4KB

Download
memory/2292-107-0x0000000001260000-0x0000000001261000-memory.dmp

Filesize
4KB

Download
memory/2292-108-0x000000001B770000-0x000000001B780000-memory.dmp

Filesize
64KB

Download
memory/2292-109-0x0000000002BB0000-0x0000000002BEE000-memory.dmp

Filesize
248KB

Download
memory/2292-110-0x000000001B770000-0x000000001B780000-memory.dmp

Filesize
64KB

Download
memory/2292-120-0x00007FF8D8680000-0x00007FF8D9141000-memory.dmp

Filesize
10.8MB

Download
memory/2292-103-0x0000000000990000-0x0000000000A76000-memory.dmp

Filesize
920KB

Download
memory/2292-104-0x00007FF8D8680000-0x00007FF8D9141000-memory.dmp

Filesize
10.8MB

Download
memory/5084-136-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/5084-144-0x00007FF8D8150000-0x00007FF8D8C11000-memory.dmp

Filesize
10.8MB

Download
memory/5084-134-0x00007FF8D8150000-0x00007FF8D8C11000-memory.dmp

Filesize
10.8MB

Download
memory/5084-135-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/5084-138-0x000000001AD50000-0x000000001AD60000-memory.dmp

Filesize
64KB

Download
memory/5084-137-0x000000001AD50000-0x000000001AD60000-memory.dmp

Filesize
64KB

Download