eternity | 10f1b78f514083fcf011f457ff24a0f8d18b1e61028893040defd596d7a60747

Analysis

max time kernel
107s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XKy9RddbaY.html
Size

16KB
MD5

2a3b9629214418c5eff515170c5f99e8
SHA1

b47c83401d8e1529a7db5f9d8101019efda7472d
SHA256

10f1b78f514083fcf011f457ff24a0f8d18b1e61028893040defd596d7a60747
SHA512

95311fdcad45495a0ec6e96e6d81c7c8bb8dcb28bd6a262ef08b46adfedb2d5539f60f1c46a295e45dc32e8bdb7f58afc97f6b4633a6e0933867235eef333534
SSDEEP

192:ne+R5pbvWhEhuwby4Y2rIArS5zpVHPpmMV/7F/FDZdLdhpI1XMD:ne+t5uwbfrFS5rHhbx97YXm

Score

10^/10

eternity stealer

Malware Config

Signatures

Detects Eternity stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/files/0x0008000000023449-377.dat	eternity_stealer
behavioral1/memory/944-414-0x0000000000F10000-0x0000000000FF6000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Downloads MZ/PE file

Drops startup file 12 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Silviozas Premium Proxy [1 Month Edition].exe	Silviozas Premium Proxy [1 Month Edition].exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Silviozas Premium Proxy [1 Month Edition].exe	Silviozas Premium Proxy [1 Month Edition].exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Silviozas Premium Proxy [1 Month Edition].exe\:SmartScreen:$DATA	Silviozas Premium Proxy [1 Month Edition].exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Silviozas Premium Proxy [1 Month Edition].exe	Silviozas Premium Proxy [1 Month Edition].exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Silviozas Premium Proxy [1 Month Edition].exe	Silviozas Premium Proxy [1 Month Edition].exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Silviozas Premium Proxy [1 Month Edition].exe\:SmartScreen:$DATA	Silviozas Premium Proxy [1 Month Edition].exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Silviozas Premium Proxy [1 Month Edition].exe	Silviozas Premium Proxy [1 Month Edition].exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Silviozas Premium Proxy [1 Month Edition].exe	Silviozas Premium Proxy [1 Month Edition].exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Silviozas Premium Proxy [1 Month Edition].exe\:SmartScreen:$DATA	Silviozas Premium Proxy [1 Month Edition].exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Silviozas Premium Proxy [1 Month Edition].exe	Silviozas Premium Proxy [1 Month Edition].exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Silviozas Premium Proxy [1 Month Edition].exe	Silviozas Premium Proxy [1 Month Edition].exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Silviozas Premium Proxy [1 Month Edition].exe\:SmartScreen:$DATA	Silviozas Premium Proxy [1 Month Edition].exe

Executes dropped EXE 8 IoCs

pid	Process
944	Silviozas Premium Proxy [1 Month Edition].exe
2060	dcd.exe
2992	Silviozas Premium Proxy [1 Month Edition].exe
1464	Silviozas Premium Proxy [1 Month Edition].exe
3648	dcd.exe
100	dcd.exe
1460	Silviozas Premium Proxy [1 Month Edition].exe
2044	dcd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 352357.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
2468	msedge.exe
2468	msedge.exe
4668	identity_helper.exe
4668	identity_helper.exe
4888	msedge.exe
4888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	944	Silviozas Premium Proxy [1 Month Edition].exe
Token: SeDebugPrivilege	2992	Silviozas Premium Proxy [1 Month Edition].exe
Token: SeDebugPrivilege	1464	Silviozas Premium Proxy [1 Month Edition].exe
Token: SeDebugPrivilege	1460	Silviozas Premium Proxy [1 Month Edition].exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 3424	2468	msedge.exe	81
PID 2468 wrote to memory of 3424	2468	msedge.exe	81
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4648	2468	msedge.exe	82
PID 2468 wrote to memory of 4784	2468	msedge.exe	83
PID 2468 wrote to memory of 4784	2468	msedge.exe	83
PID 2468 wrote to memory of 4208	2468	msedge.exe	84
PID 2468 wrote to memory of 4208	2468	msedge.exe	84
PID 2468 wrote to memory of 4208	2468	msedge.exe	84
PID 2468 wrote to memory of 4208	2468	msedge.exe	84
PID 2468 wrote to memory of 4208	2468	msedge.exe	84
PID 2468 wrote to memory of 4208	2468	msedge.exe	84
PID 2468 wrote to memory of 4208	2468	msedge.exe	84
PID 2468 wrote to memory of 4208	2468	msedge.exe	84
PID 2468 wrote to memory of 4208	2468	msedge.exe	84
PID 2468 wrote to memory of 4208	2468	msedge.exe	84
PID 2468 wrote to memory of 4208	2468	msedge.exe	84
PID 2468 wrote to memory of 4208	2468	msedge.exe	84
PID 2468 wrote to memory of 4208	2468	msedge.exe	84
PID 2468 wrote to memory of 4208	2468	msedge.exe	84
PID 2468 wrote to memory of 4208	2468	msedge.exe	84
PID 2468 wrote to memory of 4208	2468	msedge.exe	84
PID 2468 wrote to memory of 4208	2468	msedge.exe	84
PID 2468 wrote to memory of 4208	2468	msedge.exe	84
PID 2468 wrote to memory of 4208	2468	msedge.exe	84
PID 2468 wrote to memory of 4208	2468	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\XKy9RddbaY.html
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad02946f8,0x7ffad0294708,0x7ffad0294718
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2800 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1848 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7172 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,7014199929161066410,7524855095139804373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4888
- C:\Users\Admin\Downloads\Silviozas Premium Proxy [1 Month Edition].exe
  "C:\Users\Admin\Downloads\Silviozas Premium Proxy [1 Month Edition].exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:944
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
    3⤵
    - Executes dropped EXE
    PID:2060
- C:\Users\Admin\Downloads\Silviozas Premium Proxy [1 Month Edition].exe
  "C:\Users\Admin\Downloads\Silviozas Premium Proxy [1 Month Edition].exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2992
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
    3⤵
    - Executes dropped EXE
    PID:3648
- C:\Users\Admin\Downloads\Silviozas Premium Proxy [1 Month Edition].exe
  "C:\Users\Admin\Downloads\Silviozas Premium Proxy [1 Month Edition].exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1464
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
    3⤵
    - Executes dropped EXE
    PID:100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5096

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3272

C:\Users\Admin\Downloads\Silviozas Premium Proxy [1 Month Edition].exe
"C:\Users\Admin\Downloads\Silviozas Premium Proxy [1 Month Edition].exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1460
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
86KB

MD5
1ad7334f7275f2b4ad6e3a2b0e23f42c

SHA1
abb12960c9c3fd1878f3e67082a09e2412ed74c3

SHA256
22616ad748134a8fd9adfc17b3e83bab74d789b3b9280d3e9dd980d182c16f6e

SHA512
af68b7571b3cfcfe221a26dd41e6aa89ffd9cd5b991a15a58a599a686f7ff8781dad4625f6d18eca628d2d3bf0ae85c31a26cfbaf4aea323846654f6fdd273cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
80KB

MD5
a95d69210efa0c8a62bd964d3f9f236b

SHA1
57a1fd6264cfd07109b134e260cbd27e99a0ecbb

SHA256
e3d007f933650a9542c679854e26fc94dcdd883c4db40b1f4ee5b67a13f99eda

SHA512
1b965d7af2cc2a1010acad6289d8473c3562dad5461b224f2a03a3c5e821f0e99d590ec0f5c1a3579c09d93b71ac155b41d53831ae3224fa0b1f57d0b3709ab1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
45KB

MD5
f95a0faf6629fe55dba24478808491ac

SHA1
c91fbfa760c6642f522038a7e90b9445cf8c762f

SHA256
3401a6c618e31c817b75f603ff2ecfd83b8b75e4309aa09007cad5e98878f1f9

SHA512
06f2e5329db17deb104bd106cfc84ea2b321a4ddf64d6d4acf37462cc0d898530b3d913f2c48c7cc29063bb22430e9d12ebd6c9f8e32a2e980cd985a40923673

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
133KB

MD5
1f3868273326150c64c60078ced47d51

SHA1
61ebeb463126a8e4cbc0140837b0eb0986a7adc0

SHA256
fe178ed16710e7a2905bd2c89cce1070a46da53078f988da53242b2a2e862b80

SHA512
69ecc1109eebe35ab6ac4edd8b570233d203856999627a0bbdf7bc5d598fc49bbc759df1c5e6c281a966ea4ad9f3dcac78806ba486c76736425ba42f8a4078dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
105KB

MD5
8b0ddedbb27cbc9971c8667caa8a0cc1

SHA1
4350f9ba93384634faf35f41c503c99c767f1069

SHA256
748332090c4b8e20f95d0ff59f0be20fa9c889359d3b36d4b886d73376054207

SHA512
d3b4791b988fcfd9911a2158163d0c44d6797650890b5d4ac769417e09d8fc2c67edc595be8e7927de0519a85eeb3577d0c7e385bdc99d762c7a6cfbad021b39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
146KB

MD5
c64278386c2bbb5e293e11b94ca2f6d1

SHA1
6b99aa650bd12a36caa14e0127435d8f4cd3ba73

SHA256
7152a6933ee3d690ec2af3d09da9d701723d16aa3410a6d80f28ff8866f3b880

SHA512
0ccdc1515510d902c0b4a48b863c48bad86e1f766b1f9c890a64e28d91ee7c6d488241c531fc094d15b29c211da71e092587a987e24ee8e67ef8ea99c284e821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
20KB

MD5
ee51ec4233f267bc0cbd50e4d6fc624e

SHA1
60a9fe9ff48c9def3b58799bff806362db7231b8

SHA256
c653ccb3ed9f22cdafddeaef44339a87ecaee003064bacedfc68d21290455cd5

SHA512
fd467a2e89ff408d9f060b38ca0e48b1c82d3e2231580209f4067692dc9565a2c2658996c9d4d33a074d7cc0e193d382e7b201678a3a0ae196fbc33f13efb814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
42KB

MD5
f186232c3381586a193bea7bbb20ec8e

SHA1
a5845c92e1d1c15edde0d51d973e940040552beb

SHA256
f340cfc6de492eb6448e30432c0f375fee3497ae8065a5f538fd50b469f546b0

SHA512
7705ec1021f541306ce42f350addb778f5cc1b4ee32dec2c261fe349b6c5b503a90098648ae5db014d60a09876c77c17e4f07acf05d087cb6e20f487a32d6521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
525KB

MD5
16da404c3b55201d214837aeb74ae838

SHA1
62650b5d0a02bad95f188e1e18f9af36ff7ab7ac

SHA256
349df66a192b61e4db7792ad0ad58e876945c35b15f5374bc8e429621021b3a0

SHA512
d6a68a471e93ad70750b7744b48ad974a22393e1671195e2b4e7d925b4749fc552d6789bbf5d0a518ccf9d0d20ce61db3102900d93de9fc46b99d76cbc938972

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
75KB

MD5
fd9d0aaa129b915901fb06680d86d856

SHA1
145cdc161247b36177560dbb8696ee2c4c0e2e68

SHA256
5e64fe13a75aae28364cf464e24d846719034a92a2e9c5de25b9af6eb32f967f

SHA512
a3420fd8a99b9ad3189797b03a3d92e5a283bc6839a51b5c38237ff885b23cf227277c78038c7c02af7caeb027a6be793ee2ebc2cc4314d772b6a23eec4fd21b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
47KB

MD5
015c126a3520c9a8f6a27979d0266e96

SHA1
2acf956561d44434a6d84204670cf849d3215d5f

SHA256
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

SHA512
02a20f2788bb1c3b2c7d3142c664cdec306b6ba5366e57e33c008edb3eb78638b98dc03cdf932a9dc440ded7827956f99117e7a3a4d55acadd29b006032d9c5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
21KB

MD5
b4a321b999f46e57b1176981b8ac6d42

SHA1
289def47c174bb9893294228c4c88c201cea4a5e

SHA256
a76f91da898e41ab865807229345bbc3908787190bb47a92b8b0e353f9228f7c

SHA512
391c3378c6f9c05f5473757a5bfc7f5f09ad69d1f76e15159189be8256f58bb8d7ae864cf5dc9267f431673b45ae118900e7cd2a7ad80a288a8069bf8ca2d84d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
124KB

MD5
6dcccc04e0ed00f5872fee7adce29f96

SHA1
9ad5d4a0a28c2f5e4edb4170c8998ec663a00bba

SHA256
44a529340df1e7242fb47201f8443bb1ba6467cf0229b75fd297563c4d297e99

SHA512
9bcb739fd0c142bbac54ff49d5a73fbc887db0b77b30d961c09282c149252ab2ef1f488e833edd98a12c872b92222402f0e6cca4b4f1a0c689a2f48b86f82f0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
338KB

MD5
cfe306b45af035358d05c2dfba52ab5a

SHA1
1cb21ad9748fdf1eb18957c41e43b0774e5e156b

SHA256
ca67dddef17698d7c287d1212f44a0cb7bd58fb5cf31868f94f4efeacf815a81

SHA512
689394a6b56c5ea7c26af28938d86707aacaf7b26ed761649a0da2649e826a1dac3f3e6b3b6178cf423b72bbeb08d52884527d56b77a53e7b9b7ee220be392fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
56KB

MD5
4cbaddd0903a6af1fca06663d82744bc

SHA1
0c30e6ef6b0445b80c6dd362aaa6a223abd146fe

SHA256
098816cbd638cf94aaaa8b705da227bcb79f91cd0a501e5f7097b59f4e8f7cc5

SHA512
eb59d7f814882e63de7952aa4d0a66e12c7c1d8d1f2721f879d18c56680506e994f56be680aa1467ecb06d5313eb23ef9bff4b0a777434972e983f8344144d76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
19KB

MD5
c52f3521639f61d058b371c90f7340a0

SHA1
26cda00aa74d363215fe8e5de80878cf767d9747

SHA256
98dadb40ba05b9079b6c7cfdcdce83a11764b15cee748e1d6b06ef13e94f1736

SHA512
ead5c9d264cb85f32a1e4e7ca84df51b2d8fcad89abe35b8a9e461cab914224e5ee9c3b0cbcaf720ffaf43566b9d9c958667024e0e6988f948640fd782ff3f23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
64dd03918bef58c9cef11211b19165c3

SHA1
5f1b7c08a82d39e139a10ab906753b89713f92b7

SHA256
f5aba80f0b63a995288a86268571813cc73a30911d6e8b982077fb4238612d52

SHA512
33a1c42b76757183fad8c1c85d033b61f0095b73240f59a8bf9a5caa741f1f92dbef1b4fcbe2ac0b90f1d5e988b8d0efa35b615bf8018b0cbb6e6df393af145c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
caa796c5f28008a9e7abcc6115694173

SHA1
8051167ac5de75416d59d4fe611a9ddfd9177eb2

SHA256
568b1a0a914897b9664a6516b9d2454f8a771d8db33f08c2e00b2e4a47147204

SHA512
2c003c6c23dc8e0ba4a6df1cc7cb9707874177968db8c89a7becd6f2be017464413b0fed49cd26e32ae3569712da470479d32a1eb8cf47cd348a53d0db1a0550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
a6c7b88e8a85d8ddd882ab4a2b9f8633

SHA1
5f34de82df4dc736dc8e861b4c827eea493296d1

SHA256
73b04cc4bcc1407cb7857fe5e37ee08b44c94d8f884c0742e8385ee3fdf88398

SHA512
709762c403602cf93e09aaf0d7bf118be0fbdf8ea04026dfb05c707f60aaea6d79701ea2027bc5a49aecd792015ff07b3042ed542bd94cd37dbbc67c94632cc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
dfca62828432deea1f51d86d8df6f2e9

SHA1
2787f2a1e3b2ff037b3ceeab0cf8c65964eb47d4

SHA256
bfade79a4ffaed0b5d67a9eb60c3fe5794eb68fd44efa8306c77812578834cd6

SHA512
4743c53385708c8e70d5d21b07ca5d04cd8357e46ab19382eead7f878e11bd5a0552677904a20af7d34e06f813695dec990fcc40b07dcd3cffd0761638c4181c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0f1e82da2b68a36a32fd310fd96af6a2

SHA1
600f10df7ae4a5cd93aac0f09aaf10dbca3947ff

SHA256
0c0d5599e12e12728f11a77ee18ee3a0590b3194a99c9ef249564da4e228be81

SHA512
d22792e90b230d4e25bbab7184e084b90fb154ea9e9485d0e7381c1b29d40ce64f5c5e03028d03bc62f881a0ed3f8a913f351ae74f779ddbf51c92da62260242

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2f2bfda5b1aae44cce6fc4032ea2760c

SHA1
7c62ff077600724398a1bddfe3e90c52029cad97

SHA256
5775ea85f79088df4915037d3f4581f914233a8415e3c5c3992d78a2cfeda0f6

SHA512
09bb986808c7c977de126a40c5ba725ce62f82a8bbc3cf7aa96526bcee531a2847767524394693ba465e3098d5b543acf5290754e86d005b267e8897b5bc36fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8b6c29f3a623572e61a56a1a7711b73e

SHA1
9115ffe15ccf0ac0247e5b4eefd5fea984ca0d40

SHA256
158078f1283f5cb60c26c9d20398920e0dc0b73f6596d1daf35523520dcf796a

SHA512
c84668d75b8e9da7f7d4c26742a0c0f3442837f4560639218966f8fc7d87b862744724a4dc21e586dc70866193b7bcd0df7e6d18691f4b1b1109f5388411a7bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
915a1a181d0e713ebc465f380cf8d6a5

SHA1
9a5f2bb273f6d026ce72f025830ddf1d43520a8f

SHA256
c2bfb90d839beecdcc7927fcd5f357f88c8019e79f1eb305ef71e07959926d61

SHA512
81344232d94ddbbd939b7fb308bddc6e4f7b1313ef6e4f933ed70d6d304f7c05f6e57e34555f41b7e2b6f785b5b5e3a0a8f739d5b04ac95e3f84963c2be0081b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
72450798b7bc1680c1a75fbc116d00d2

SHA1
ddae2ee409da9c70779d995293a85ac684c879e5

SHA256
5029c2b73cd16f77e55c32b04cd7206ff56aa915ab6972c6e315e8dbd90f1f87

SHA512
724bb8442a0e3051685e8790cc79023113816695a4313ff76bc2d4546b065596afa4356c6775df8d72471fac8c9be84160ded31cb1df3b1118dea1dadac01d8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ce5cbad25782753c70f70c19ce8705c0

SHA1
11075f139bf1eafc72e15bb73f4ddbccb4781766

SHA256
c604ed87090c5d18680b02174e7f11f0939fc4a3f3eaf69509b231fc11d80921

SHA512
42e4c12abef20df61395342d6509cf4766fa997b91b01756e541bcc19e1a95deaa3e35213967275dfab340ddf78c5c5a06dc840c315c4923c81a6c93c894872c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d52ea744cd716310b86d6625d35cd38c

SHA1
7f4c2fe0d8cc495cdbe585e602a57bd884ad641a

SHA256
80c513793fd89358689b1a950a05ee53e2622c32bf99d3b65e52ad7e53c5d7e7

SHA512
2c2fb5640e4f78bdb926766da3a5cd4458303c3cfa29840353fff76c8a1ef4db56142aa12e12a1fdcad8de37a11ea146fc03245ce18db05f132155e299f16d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
70b95e32ed44c9f3c1c2d616aac56db6

SHA1
7fff0438db42db05e0efdc3720b95bda900e6437

SHA256
885bddb01ca9c89c269d4a2e0d63be79461dcb5074e4c124e31cb53d818e45b5

SHA512
03fb6bfba9c2de6cccb467e3bd7d0c4a33f55d6e60ad0efe5e1770a58bc2e13e7fc6a8a4fbd17160a95af59204cb3d6a52cf7bbede2d634fa5143d36f3964bab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f03c.TMP

Filesize
1KB

MD5
ae7102893eeaea3077c084ff0083cd0e

SHA1
f5fd2ea52f21bc9eaff0974629e375ffcb8d4131

SHA256
1908be3184b8d52eb63fa118dee8e0f39153ff915de211759ad870577a86e270

SHA512
eaf562ec23ddd7e0c942ded68e087e1fb64aafa8e2c16de20ae3cfdc37a4963b55d4ba5d5a7e1d013775d4e3a9f6efc08f3b9ca765fc4ea0b09b5fa47319cd4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c2850343-1469-4723-9482-54a83c3c59c2.tmp

Filesize
7KB

MD5
b44b9c217b8a510a0d3bf6c3567888ec

SHA1
12cc65b14d63fd44d516db1e0c057dab021d6a60

SHA256
ecc3c2743f0319009eb02ea8409a7ffa6bb7b8379ee6240a317f9f3231d44c43

SHA512
1ad9f4da8add56bc18626b2340a8954250ed82a9460c844ea37d0710a8abee2126c600f9c19ab6bb2dbd0f23e8e463411e1b77c7a62cc5ed3a3e599be9083be9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e831911645e9c2a7b1dd02b1649040a1

SHA1
6dd33ff752842d1306b5af0c6f18b9c82a8af178

SHA256
5067c2d71d095d6d13fd5ec967b2ff5139c929c6512d57c77ffd93e4620da53d

SHA512
1c6b24bc4ff2f5d6f0b05a38a927c3700db2e62d8426b1aae340bbee0331b01d81d1cd7418be3d3d364325ec2f22687544eaabcfd38374ffbce39b48a3aa1221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8daf29219dd85dd31d1074eaf13191b0

SHA1
b4244951109d7f242e27ac2a96d43290b4e7ee88

SHA256
8d9c2094a415b4968b3dddf45dde05a01907ee98553ff574aa2c96e0b8947ce8

SHA512
5a8dfffc4c70f357bfefdf8d0511e2e87ca44893f692c8c60c06479bcf479686eb3ba33e28bf4964a293b12921a0ef8e71309241115af4791a29f7f54ffcbc06

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Silviozas Premium Proxy [1 Month Edition].exe:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 352357.crdownload

Filesize
885KB

MD5
c3de656fd297661f5c03c20130ecf78b

SHA1
a01ec8e549f1d1f668587d4a48356c59eb25efc1

SHA256
71c2dc9d6876c810a479e0026b6720a9dda91b16a3b913bffa76245f725d2104

SHA512
477e879af13c61417eb796bbf3dda0f2f73e266464913e7b5321abad366de13d932fbc5cde8fa67663f86dc95ab110c7cbc3c13640ae9a56914ce004236dc296

Download Submit
memory/944-416-0x000000001BAE0000-0x000000001BB1E000-memory.dmp

Filesize
248KB

Download
memory/944-415-0x000000001BB30000-0x000000001BB80000-memory.dmp

Filesize
320KB

Download
memory/944-414-0x0000000000F10000-0x0000000000FF6000-memory.dmp

Filesize
920KB

Download