hijackloader | hxxp://bsite – hxxp://eternaldecay[.]io

Analysis

max time kernel
161s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-08-2024 19:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://bsite – http://eternaldecay.io

Score

10^/10

hijackloader stealc eternaldecay8 discovery execution loader stealer

Malware Config

Extracted

Family

stealc

Botnet

eternaldecay8

http://45.156.27.45

Attributes

url_path
/dc0de592dc0f725c.php

Signatures

Detects HijackLoader (aka IDAT Loader) 2 IoCs

resource	yara_rule
behavioral1/memory/6032-1204-0x00000000000A0000-0x000000000052D000-memory.dmp	family_hijackloader
behavioral1/memory/1096-1233-0x0000000000400000-0x0000000000549000-memory.dmp	family_hijackloader

HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5608	powershell.exe
4568	powershell.exe
2780	powershell.exe
5812	powershell.exe

Downloads MZ/PE file

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/files/0x00070000000235d4-1099.dat	net_reactor

Executes dropped EXE 4 IoCs

pid	Process
2964	Eternal Decay Setup.exe
5408	EternalDecay.exe
6032	snss1.exe
1096	snss2.exe

Loads dropped DLL 54 IoCs

pid	Process
2964	Eternal Decay Setup.exe
2964	Eternal Decay Setup.exe
2964	Eternal Decay Setup.exe
2964	Eternal Decay Setup.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe
5408	EternalDecay.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 6032 set thread context of 728	6032	snss1.exe	141
PID 1096 set thread context of 1360	1096	snss2.exe	153

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Eternal Decay\ko\Microsoft.VisualBasic.Forms.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\pl\WindowsBase.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\zh-Hans\ReachFramework.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.Linq.Parallel.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\es\WindowsFormsIntegration.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\fr\System.Windows.Forms.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\ja\PresentationCore.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\ko\WindowsFormsIntegration.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\D3DCompiler_47_cor3.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\cs\System.Xaml.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\it\System.Windows.Forms.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\de\System.Windows.Input.Manipulations.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\es\UIAutomationClient.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\ko\System.Windows.Controls.Ribbon.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\Microsoft.VisualBasic.Core.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.Collections.Immutable.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.IO.Compression.ZipFile.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\es\UIAutomationClientSideProviders.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\ko\PresentationCore.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.Security.Cryptography.Cng.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.Security.Principal.Windows.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.Threading.ThreadPool.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.IO.Pipes.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\fr\UIAutomationTypes.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\pl\System.Windows.Forms.Design.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\PresentationNative_cor3.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\es\PresentationUI.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\it\System.Xaml.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\pt-BR\System.Windows.Forms.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.Diagnostics.Debug.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.Runtime.Serialization.Formatters.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.Threading.Channels.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\it\WindowsFormsIntegration.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\it\UIAutomationClient.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.Net.Quic.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\es\ReachFramework.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\es\WindowsBase.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.IO.FileSystem.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\pt-BR\WindowsFormsIntegration.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\ru\PresentationUI.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\zh-Hans\WindowsBase.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.IO.Compression.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.IO.Pipes.AccessControl.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.Security.Cryptography.Algorithms.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.Security.Permissions.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\it\System.Windows.Forms.Primitives.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\ru\System.Windows.Input.Manipulations.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.Linq.Queryable.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.Private.Xml.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.Windows.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.Net.NameResolution.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.Xaml.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\pt-BR\PresentationCore.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\pl\System.Windows.Forms.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\PresentationFramework.Royale.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.IO.FileSystem.DriveInfo.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.Security.Principal.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\pl\System.Windows.Forms.Primitives.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\ru\ReachFramework.resources.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\PresentationFramework-SystemDrawing.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.Net.Http.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.Reflection.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\System.Threading.Overlapped.dll	Eternal Decay Setup.exe
File created	C:\Program Files (x86)\Eternal Decay\cs\PresentationUI.resources.dll	Eternal Decay Setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eternal Decay Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snss1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snss2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.xrf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.xrf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2904698490-2540843659-2047741361-1583039222-628509060-1343416660-4183458959	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2904698490-2540843659-2047741361-1583039222-628509060-1343416660-4183458959\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2904698490-2540843659-2047741361-1583039222-628509060-1343416660-4183458959\Moniker = "cr.sb.xrf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2904698490-2540843659-2047741361-1583039222-628509060-1343416660-4183458959\Children	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 163076.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
3472	msedge.exe
3472	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
2500	identity_helper.exe
2500	identity_helper.exe
4876	msedge.exe
5348	msedge.exe
5348	msedge.exe
5608	powershell.exe
5608	powershell.exe
5608	powershell.exe
4568	powershell.exe
4568	powershell.exe
4568	powershell.exe
2780	powershell.exe
2780	powershell.exe
2780	powershell.exe
5812	powershell.exe
5812	powershell.exe
5812	powershell.exe
6032	snss1.exe
6032	snss1.exe
6032	snss1.exe
728	cmd.exe
728	cmd.exe
728	cmd.exe
728	cmd.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
4976	explorer.exe
4976	explorer.exe
1096	snss2.exe
1096	snss2.exe
1096	snss2.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
6032	snss1.exe
728	cmd.exe
1096	snss2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5608	powershell.exe
Token: SeDebugPrivilege	4568	powershell.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeDebugPrivilege	5812	powershell.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2964	Eternal Decay Setup.exe
5408	EternalDecay.exe
6032	snss1.exe
1096	snss2.exe
1096	snss2.exe
1096	snss2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 4376	3672	msedge.exe	86
PID 3672 wrote to memory of 4376	3672	msedge.exe	86
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3020	3672	msedge.exe	87
PID 3672 wrote to memory of 3472	3672	msedge.exe	88
PID 3672 wrote to memory of 3472	3672	msedge.exe	88
PID 3672 wrote to memory of 1460	3672	msedge.exe	89
PID 3672 wrote to memory of 1460	3672	msedge.exe	89
PID 3672 wrote to memory of 1460	3672	msedge.exe	89
PID 3672 wrote to memory of 1460	3672	msedge.exe	89
PID 3672 wrote to memory of 1460	3672	msedge.exe	89
PID 3672 wrote to memory of 1460	3672	msedge.exe	89
PID 3672 wrote to memory of 1460	3672	msedge.exe	89
PID 3672 wrote to memory of 1460	3672	msedge.exe	89
PID 3672 wrote to memory of 1460	3672	msedge.exe	89
PID 3672 wrote to memory of 1460	3672	msedge.exe	89
PID 3672 wrote to memory of 1460	3672	msedge.exe	89
PID 3672 wrote to memory of 1460	3672	msedge.exe	89
PID 3672 wrote to memory of 1460	3672	msedge.exe	89
PID 3672 wrote to memory of 1460	3672	msedge.exe	89
PID 3672 wrote to memory of 1460	3672	msedge.exe	89
PID 3672 wrote to memory of 1460	3672	msedge.exe	89
PID 3672 wrote to memory of 1460	3672	msedge.exe	89
PID 3672 wrote to memory of 1460	3672	msedge.exe	89
PID 3672 wrote to memory of 1460	3672	msedge.exe	89
PID 3672 wrote to memory of 1460	3672	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bsite – http://eternaldecay.io
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdef0446f8,0x7ffdef044708,0x7ffdef044718
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,265099628901836658,13057726988063252739,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,265099628901836658,13057726988063252739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,265099628901836658,13057726988063252739,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,265099628901836658,13057726988063252739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,265099628901836658,13057726988063252739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,265099628901836658,13057726988063252739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,265099628901836658,13057726988063252739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,265099628901836658,13057726988063252739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,265099628901836658,13057726988063252739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,265099628901836658,13057726988063252739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,265099628901836658,13057726988063252739,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,265099628901836658,13057726988063252739,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,265099628901836658,13057726988063252739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,265099628901836658,13057726988063252739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,265099628901836658,13057726988063252739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2640 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=device.mojom.XRDeviceService --field-trial-handle=2076,265099628901836658,13057726988063252739,131072 --lang=en-US --service-sandbox-type=xr_compositing --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2076,265099628901836658,13057726988063252739,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,265099628901836658,13057726988063252739,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4164 /prefetch:8
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,265099628901836658,13057726988063252739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2076,265099628901836658,13057726988063252739,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2156 /prefetch:8
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,265099628901836658,13057726988063252739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5348
- C:\Users\Admin\Downloads\Eternal Decay Setup.exe
  "C:\Users\Admin\Downloads\Eternal Decay Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2964
- - C:\Program Files (x86)\Eternal Decay\EternalDecay.exe
    "C:\Program Files (x86)\Eternal Decay\EternalDecay.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:5408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\bf3572f9-de0a-49a6-9cc4-29a5ffe03966\snss1.exe
      "C:\Users\Admin\AppData\Local\Temp\bf3572f9-de0a-49a6-9cc4-29a5ffe03966\snss1.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      PID:6032
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:728
      - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        6⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\bf3572f9-de0a-49a6-9cc4-29a5ffe03966\snss2.exe
      "C:\Users\Admin\AppData\Local\Temp\bf3572f9-de0a-49a6-9cc4-29a5ffe03966\snss2.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      PID:1096
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,265099628901836658,13057726988063252739,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3784

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a0 0x304
1⤵
PID:3740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Eternal Decay\EternalDecay.dll

Filesize
726KB

MD5
4fb8e2ef58229a97cc9d177ff895c014

SHA1
5d552db1868fc215005657cdf67d9db6199bb209

SHA256
438aa02fe237c469de3d8fe134a563ca05dcba63e3198da025de8054d3290431

SHA512
c1e659219faa4c72582f31c97f9947b8359ca8b8c2ebdc2db6f5eaa4e46c254bca07e8ed9d57dfccdcdcf1e5332713050c5b874f75555f7b3d8928bc24f8b9e8

Download Submit
C:\Program Files (x86)\Eternal Decay\EternalDecay.exe

Filesize
324KB

MD5
2b3c10fe3ae38da4e973a8a5f6986042

SHA1
4d016490a1bd1e2b72b2a363557d19cdde55e8d1

SHA256
2ae0a51b45bdd453525637f1dfdd4bc6f32b9492d40d5d1b9dc464a44e997d31

SHA512
6b9baa37416604d7d25ccf0a113c49707f9db78e3d77944170bc9c3d36e4526863d5edd6e36d10e2f9fc73aa78bb0c19565fe8603f1ede56070fe0626ece193d

Download Submit
C:\Program Files (x86)\Eternal Decay\Microsoft.Win32.Primitives.dll

Filesize
15KB

MD5
300c95ff95b52e8a02fec6bfcfa58225

SHA1
b646f89fcd463ad5c19889b4fea40540568b780c

SHA256
f1b40565e5c4c41da810aee5b7d2272a0906e88f796812435aa5ed712bcac40c

SHA512
9bfe0eb6eea98b2d35aa42986a273ec82424143965e173b32bb4b7e5537580a027940a6952a45fc54f0b665e871deb2a95651106c2f24c7de3b3d3cd2dec7e89

Download Submit
C:\Program Files (x86)\Eternal Decay\System.Collections.Specialized.dll

Filesize
102KB

MD5
cc26e9e30ffab763a1e54c0ef3713382

SHA1
c3be6646b7a4576ebd7729dbf4dccbd1fc159d51

SHA256
0cbabb81eae22f4c07c6c846054d207ae3f25da15649eb7fa29e4e2cecd24db4

SHA512
c8e57fb70cfa7667f9a5484c99eedd0bf34004ee26e9642e99a6b90624caa804af571d8aaafa7e9b121550af58205f8ed197b4ddb928210d394ff0b4c1897149

Download Submit
C:\Program Files (x86)\Eternal Decay\System.Collections.dll

Filesize
254KB

MD5
92063926c04f2e4bf5b5fde16542831d

SHA1
e7be34eaff2d3d8796911d21f1fdbb93bf231dec

SHA256
9193aaef3ea8f19408f88c25fcaf5880e7836d1c35028d7e4077f6090b083541

SHA512
e855ee37980d1da2d143ee39133b05fff81937e529cffe74433e73088549daabd3abadbf05f3765bf3ffffd50313f0ed966efec0eb244d7363241affd73cc29f

Download Submit
C:\Program Files (x86)\Eternal Decay\System.ComponentModel.Primitives.dll

Filesize
78KB

MD5
1c59c00ab0850af4b4d2bafd6be47db3

SHA1
4c6185b2f42987e25a5fdf2aa30cf4150de25d5b

SHA256
133ec34432ab8fa4f63ade636193864b6a62a089a0c98d746f5532c8a52f437b

SHA512
8425c02c4afb274e862e4ed5dd1c766ebfa1bcf5bf59018d86238014a52603331a8b7c1e233f5a1f22171e90132ddd585db0d2561ff2cd287d703397afdff4b1

Download Submit
C:\Program Files (x86)\Eternal Decay\System.Diagnostics.TraceSource.dll

Filesize
142KB

MD5
fe6a4b96e144131788108c8396a849eb

SHA1
40e6e5d03cfe036645ae854d5a2262faec6bed32

SHA256
22365ee4e3ba3c991d495e41f92e29bf6ddb38a48c44f55651271b80ee62b6d1

SHA512
61644c0e970dd6a6ff697b110bf99962931dd94deda5a966ea0fded3d23cba7433b802656295e04f1a95421774ea3c838f0a642d26b5e46ae6c05becb52eb7f1

Download Submit
C:\Program Files (x86)\Eternal Decay\System.Drawing.Common.dll

Filesize
1.5MB

MD5
e4715322db624dc52947a42ac67757ab

SHA1
ba0b0850142ecc3910927d6f2e5781b896d7d442

SHA256
75b1e772a4355145364121af00e5b5cf06c7212aa53d662fdc996bc11e8092a9

SHA512
3c86d44eb209a3a1f2001968a2b139e532a0513fd2decff04aa1bf8b30b6202c70fc0e7ac8b22ace563023671259cd74cf65062132e7f1b97d3580621686b05a

Download Submit
C:\Program Files (x86)\Eternal Decay\System.Drawing.Primitives.dll

Filesize
130KB

MD5
b5ca10a41cc865048491f617678722a9

SHA1
afe171d9d676b78983b802e18ef8e00927073c64

SHA256
cbe9fbb1d1e4850460854474ffd8c01ddcc756dcb33a86d1674c0cb2e2a0b026

SHA512
2afdce56b7eec6deb82f8b2d5ec3029b5a0ee1e8bbf2e0ff9a0a5310bf265ddcdf63660546b4dbcc3c5fb0cba3cbb94f2408fe5cb4d14dbe0e74aba6dd5a2192

Download Submit
C:\Program Files (x86)\Eternal Decay\System.Private.CoreLib.dll

Filesize
12.6MB

MD5
805cf170e27dd31219a6b873c17dce88

SHA1
ac90fa4690a8b54b6248dcb4c41a2c9a74547667

SHA256
ba7e61a00e7a4634b5c5a79b83126f75580ceec235c613000c3efbc01826cad0

SHA512
fa946aae906b66cb5570155a1c77340f2b6d4efb9be16068da03a8f1c5b5f37ad847d65cd1416017db19375dc6a72670300da4c766e6d9bb1a00374f492bd866

Download Submit
C:\Program Files (x86)\Eternal Decay\System.Runtime.InteropServices.dll

Filesize
94KB

MD5
49c86e36b713e2b7daeb7547cede45fb

SHA1
75fe38864362226d2cce32b2c25432b1fd18ba37

SHA256
756de3f5f2e07b478ac046a0ac976b992ef6bc653a1be2bb1e28524a4ff8d67d

SHA512
a9bd42b626158c540be04f8d392620daba544a55b7438d6caefe93b9df10ec2219f28959c4e0d706a86b92008275de94dfdf19de730787cdacf46d99fc45e3a9

Download Submit
C:\Program Files (x86)\Eternal Decay\System.Runtime.dll

Filesize
42KB

MD5
53501b2f33c210123a1a08a977d16b25

SHA1
354e358d7cf2a655e80c4e4a645733c3db0e7e4d

SHA256
1fc86ada2ec543a85b8a06a9470a7b5aaa91eb03cfe497a32cd52a1e043ea100

SHA512
9ef3b47ddd275de9dfb5ded34a69a74af2689ebcb34911f0e4ffef9e2faf409e2395c7730bce364b5668b2b3b3e05a7b5998586563fb15e22c223859b2e77796

Download Submit
C:\Program Files (x86)\Eternal Decay\System.Security.Cryptography.Csp.dll

Filesize
15KB

MD5
c7f55dbc6f5090194c5907054779e982

SHA1
efa17e697b8cfd607c728608a3926eda7cd88238

SHA256
16bc1f72938d96deca5ce031a29a43552385674c83f07e4f91d387f5f01b8d0a

SHA512
ae0164273b04afdec2257ae30126a8b44d80ee52725009cc917d28d09fcfb19dfbbb3a817423e98af36f773015768fed9964331d992ad1830f6797b854c0c355

Download Submit
C:\Program Files (x86)\Eternal Decay\System.Security.Cryptography.dll

Filesize
2.0MB

MD5
75f18d3666eb009dd86fab998bb98710

SHA1
b273f135e289d528c0cfffad5613a272437b1f77

SHA256
4582f67764410785714a30fa05ffaaad78fe1bc8d4689889a43c2af825b2002e

SHA512
9e110e87e00f42c228729e649903ad649b962ae28900d486ee8f96c47acca094dbace608f9504745abf7e69597cdef3c6b544b5194703882a0a7f27b011fa8d5

Download Submit
C:\Program Files (x86)\Eternal Decay\System.Threading.dll

Filesize
82KB

MD5
32aa6e809d0ddb57806c6c23b584440e

SHA1
6bd651b9456f88a28f7054af475031afe52b7b64

SHA256
e8d1f5c422ee0ba3b235b22028ab92dc77c1ff9774edc0b940cad7224a30ba7d

SHA512
fe43b3d6ed5c37d59a44636d3c7522a88d83e6ec074bf69d3cbb6e5454fdd8f0523ea10fdf6fd452cbd0e2fc159cf9d03dfad6b30e80e400e7f1773b5a2e8632

Download Submit
C:\Program Files (x86)\Eternal Decay\System.Windows.Forms.Primitives.dll

Filesize
2.9MB

MD5
8129c2d72bcba8b50576e7c43e558832

SHA1
f4892f78d2496f3a2e1fa2380ff68fbeb62e2dca

SHA256
5794a3996a0b4ab9cb13f3de0f87d50462615a7d0eb1d243d9324a682c1b58cb

SHA512
40fafbf9590d2b2c8f487f44708e9e97ddce03b1487be5c7cb3d4c92bdb7100a98aebada379f63003f0dd9d447ee2b0b9dfa0b057320ac05f7f77b31c5ffa97d

Download Submit
C:\Program Files (x86)\Eternal Decay\System.Windows.Forms.dll

Filesize
12.9MB

MD5
a51632facb386d55cc3bc1f0822e4222

SHA1
59144c26183277304933fd8bb5da7d363fcc11fa

SHA256
efc52dbbef5202d9ff424d7adc6e2249b66450a5fd5414891776fc617b00123e

SHA512
2a8d8e2ee8168e6f79476616385320f463ebc161c7393db2b18a7d35ca0111c5100b83954c5eabfe32b12cac3dbfdc514271dde4cc4468dd26235eb7020d9c14

Download Submit
C:\Program Files (x86)\Eternal Decay\clrjit.dll

Filesize
1.7MB

MD5
8b81a3f0521b10e9de59507fe8efd685

SHA1
0516ff331e09fbd88817d265ff9dd0b647f31acb

SHA256
0759c8129bc761fe039e1cacb92c643606591cb8149a2ed33ee16babc9768dcb

SHA512
ea11c04b92a76957dcebe9667bef1881fc9afa0f8c1547e23ada8125aa9e40d36e0efaf5749da346ba40c66da439cbd15bf98453e1f8dab4fe1efd5618fdc176

Download Submit
C:\Program Files (x86)\Eternal Decay\coreclr.dll

Filesize
4.8MB

MD5
9369162a572d150dca56c7ebcbb19285

SHA1
81ce4faeecbd9ba219411a6e61d3510aa90d971d

SHA256
871949a2ec19c183ccdacdea54c7b3e43c590eaf445e1b58817ee1cb3ce366d5

SHA512
1eb5eb2d90e3dd38023a3ae461f717837ce50c2f9fc5e882b0593ab81dae1748bdbb7b9b0c832451dfe3c1529f5e1894a451365b8c872a8c0a185b521dbcd16b

Download Submit
C:\Program Files (x86)\Eternal Decay\hostfxr.dll

Filesize
342KB

MD5
16532d13721ba4eac3ca60c29eefb16d

SHA1
f058d96f8e93b5291c07afdc1d891a8cc3edc9a0

SHA256
5aa15c6119b971742a7f824609739198a3c7c499370ed8b8df5a5942f69d9303

SHA512
9da30d469b4faed86a4bc62617b309f34e6bda66a3021b4a27d197d4bcb361f859c1a7c0aa2d16f0867ad93524b62a5f4e5ae5cf082da47fece87fc3d32ab100

Download Submit
C:\Program Files (x86)\Eternal Decay\hostpolicy.dll

Filesize
388KB

MD5
a7e9ed205cf16318d90734d184f220d0

SHA1
10de2d33e05728e409e254441e864590b77e9637

SHA256
02c8dbe7bf1999352fc561cb35b51c6a88c881a4223c478c91768fdaf8e47b62

SHA512
3ecbaf20946e27d924a38c5a2bf11bac7b678b8c4ebf6f436c923ea935982500e97f91d0e934b7fd6b1fc2a2fd34e7d7b31dbbe91314a218724b3b2fd64c4052

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\20f2f607-ef0b-44ce-b0a1-c8a8f277f22c.tmp

Filesize
6KB

MD5
1aa0b6040c2c2408a6e99c1993c168a3

SHA1
a05fc862b8b85f01925037ada9bf58defcd6957e

SHA256
af52eed30c73b65a4c90b85353109ef6050e1d8976fd7c79104d04bda7b51505

SHA512
5878eb2817932bd6944da4d20a7ff0a42c6152af1d57a0ac88299d1d3776334ff9a7fd04610c563c3e43e074ebc41063ef8d32ed73a0e768ecf3f92877345df4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
1024KB

MD5
61de84aff71a002479bf2451cba689c0

SHA1
7c69e240eb3b4d57fe85457b7b7eb05665fbf8ba

SHA256
601d0e489a017ea13ca6e75f65be3207b100115dc2a2fb97e2c945990a9c44d3

SHA512
c200ed615aab82c4cb313db9b7792282200c247b799a60e5be45f7e767755c435ffc80759053d1db26491c9272b924424ab7d94b0e94d0cb4b53c413cbefae3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
1024KB

MD5
9d37e57c479e147b6858ac9538c359f6

SHA1
bfb1e53399d36d85dc1aa56a32d887731c80cec0

SHA256
506023b602c7cb8e9f9a30b03116f1ff431ea96badc86e9b0c4feebee3836787

SHA512
51d0882b853c4a3d26fb057cc6858fce83a608c4f3c68c2783e5f1a0a959bee82fa58e8d5b65b41965893f376334ff4655d10da069934a8c265d293c24537175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
dfd1c41c8704a8db9eff0874f5e2345e

SHA1
017842e7e3d9afabed35dcfbac4d50cf805e2b12

SHA256
131d442a515f6ad85a961ebc1a274dfcbc81082915bfd11978d14f70ddd8cdc3

SHA512
7334259804997570d7b41cef814736191fac8697c3402f79f7f7ffcf37ca165b2aaf25bfcd242c771663718d16be5acbb75ad8a745ca34a36df069886e4871d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1021B

MD5
72fa58b2667919f9845e29721e70ce80

SHA1
85e1c7d1c540b015148e52f139edeeb39160a3d0

SHA256
1bd35d88d71b4d3ff7655220e95a1cf78fff89494d414bf8eb152d1c09f5c695

SHA512
9a14aaeaf2e2ed0a9ebf524750230cce3e045676e220e9a3925fb1cde10c6007d727740bf1cbf26aec45c65c0fa402da94c53fb145e3dff024d4206f64c71470

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5b233351abfe4adfab8b3c063026cf7e

SHA1
da1da358579e498311f557b6f6d68dccfd612a01

SHA256
80d3757ae666050dd7495930098fcc763ff3e842b05750f6d91b280190f7f3f2

SHA512
00682e99043e166bb48a9ab1974e05dabaeda4119e049ccb9d60db2fe6dcc85b0546a628ade2e7fa8cd3878075c7093fab551ac5e3418a6213e2f0f17a658a03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0515eaafcd02d7d914b3499b47ea708f

SHA1
cf789b5c299d95442854ebb99f056a5e9243ae86

SHA256
a562ff3e0e45397a8b3975e0ae516161c73bf6c232d2e410796aa487c5f30a42

SHA512
5a6cbcf2032161cc4d529840b1ace3c9ad0cf51732ae1a4227998eff65af89bd1c380a9c5a8634aeb2ae808f44bc690b5bc3a778ca552cff92a8ab6f10774ae7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
52083060ab6a904e9f90d7e652523356

SHA1
c24eda145cfa93113146e9281ba3a2e82d415b4e

SHA256
ab7f5575dba9a190fa66571dac0182d0e17c43bd29c7596c0432f3287a04d5da

SHA512
6d55b30d4c3497512ef4df0fecbc7da2d29629d137d83467ec89d471961b2c96ddf48c266cd78525886e48a87c1262fc417b86a795c10480e767c1155bb2dac3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
151abcdacfc1b14263da057cc926d44c

SHA1
54e1a39caa9ca1eabda49543a51fb86b1e1b91b5

SHA256
587bedbad1f63cb32770dcc274f15630b6d39b765d78575624cfc9a342c66ce0

SHA512
26feedb885b2f51b8b9038ef35082d45929e9003789d57be0226ebf26e2d58bd400cf280385c4e333439471d38253af10336b4783ccfc5c3167b5dbe8025d9ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
119ee9bf50526cc800ffa139a0772da2

SHA1
59cd0beae2cd0abd36174a1cba470972d6883fd3

SHA256
c1e7a2cceb87faee0e7c2cb56dded5c2d335edcd08131397bef51085dd90fd6b

SHA512
59e08a74241d3af0df2cff52a686f4c553bc277fee273f409466be5288049b713c2881ad91a215be8f8d1adf66c8b3c8297573a053ac31cd5e41ae074137dac4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58314c.TMP

Filesize
370B

MD5
db56cb903e342ba11c44d8bd2043d93d

SHA1
8e34afea41bcd55ba9fba444abd1625cea72782d

SHA256
1820b0e0f232a4827f905db687a338b46882fb68a96fac3ff9ef6c06b6308323

SHA512
a8a07682b7ec9a3f57638638fa5ac6e8373989d73cfcbc7196f22c6d9f7a61add7dcb8dc2535a96fed678d2f19f3f30079b6f983f9cf57b584b54eb6107a4581

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_00000e

Filesize
20KB

MD5
e8e1f8273c10625d8b5e1541f8cab8fd

SHA1
18d7a3b3362fc592407e5b174a8fb60a128ce544

SHA256
45870d39eb491375c12251d35194e916ace795b1a67e02841e1bbcb14f1a0e44

SHA512
ca77d40ec247d16bc50302f8b13c79b37ab1fcf81c1f8ab50f2fc5430d4fabc74f5845c781bd11bb55840184e6765c2f18b28af72e1f7800fe0bb0b1f3f23b24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e916b7949f3166108e0cbdc9bc088091

SHA1
3c88b5c4485b96ff2b192e2dc9d10fe9fc9f8acf

SHA256
689bc7c7f1dbdd6914503af7e9110536ddec4e6c2e4332efdd22c6a21037dbb3

SHA512
aeaaece32031f42d698e28b47f95fc3e74183e17f265811d70666a86c0521d6631dd60123a5deec74bd7f8db004da14a499b0f630d96c021c497bf66e40aa8fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
926204bc07d6dc749829e8b015595759

SHA1
849123f44f569f0df70f512b988db2a4cd72b9f9

SHA256
1914e008af21a6d31ebbd233ff5633c6cce11c08a0351c1e21c14c10a5f59c1d

SHA512
afc7a04afdc9cc85741b00c2107e9c5ea17814641bd1300bcd1be7377b2d15eb22a62df7a04f1f6a7cd18d5d411b82fe96097716b66dd31e46618326a4f6766a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ce104b32f7b903b5554a6afb1cbb1f98

SHA1
f96d33d5c8731893f2ca501b199385e5298c1884

SHA256
dcb14fd728ca35fb57f8ccc324239434a60b3726187088f629340c21d6434fa1

SHA512
daf4433587db915e36308ff6d749bfef3b3a75923efb90bd52ce0a0363910d9bc27df0e0ed3c7671ba286df6e53ecdcda188ca066910408be97e477345767ec6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cyc1010y.acm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp5DBD.tmp\InstallOptions.dll

Filesize
15KB

MD5
d095b082b7c5ba4665d40d9c5042af6d

SHA1
2220277304af105ca6c56219f56f04e894b28d27

SHA256
b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c

SHA512
61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp5DBD.tmp\LangDLL.dll

Filesize
5KB

MD5
50016010fb0d8db2bc4cd258ceb43be5

SHA1
44ba95ee12e69da72478cf358c93533a9c7a01dc

SHA256
32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

SHA512
ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp5DBD.tmp\System.dll

Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp5DBD.tmp\ioSpecial.ini

Filesize
1KB

MD5
cdd9aa1bfd450b36304c61f9479306cf

SHA1
0bf24c1fc707509631a058d25389e868bdef3bd9

SHA256
1e7950dbfcae7957b66dda07527efb131478e16dd12ca76080641c87362f5d9d

SHA512
5e7b0969dd0b1df8e619a27be95085f86e3e949e530e1a72feb6c1098a420722564ec0b16d7f132eaabccdc40468d5c7ff0b0f74823e93a90f2a8394965dc196

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp5DBD.tmp\ioSpecial.ini

Filesize
1KB

MD5
26b602e38d498bf3d1989b70afacdf5e

SHA1
0abba29f3cdc316958bf48a4d614bcd9743bfbf7

SHA256
38ee4a4db72c9eece6c13f5830a6112f2202bd5abad120a6818dcac179b99d0d

SHA512
c1531fc8a20234c51db94bedecd4cd9b0147acb1a30de5f3bc306be7dfa610f53893130c905cc6629c13dfe21947accf67169b797102a315c803ecc688c57585

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp5DBD.tmp\ioSpecial.ini

Filesize
1KB

MD5
5f6b3b0c9d8e2a8cba6a0d10a9b03ad2

SHA1
2f40a8c30440a70270510f9055d2d02f3d3a1018

SHA256
ec2bbb108fcbf704e4048df13dda96ad71d38565fcf409e0c1aaa26934056fae

SHA512
14d87b414da2dc76f511d8b9eb68f842397911a97540e5b77d9d170bf2ace8223a5f2f17510f4274dc9a6c4315037460e312d786d160c51eeb8ceaa04f31fd54

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 163076.crdownload

Filesize
47.7MB

MD5
9b4759b537126503a286bb395bfbed65

SHA1
c65f7515760b0ef2bfda009dba4a94471abed379

SHA256
22e222983cef8df9596849918906d9b2fbf6b04198d9d72400c3fa4af6e94da4

SHA512
33d33b3491f1fabc97c78f2a39f136698d3aba5bf695dc5050ce3b36fd301a6edbce2b9e9203c51135409b6e19d6bc85f77e0721bdc13642ee71fd7d6d84f759

Download Submit
memory/728-1210-0x0000000075300000-0x000000007547B000-memory.dmp

Filesize
1.5MB

Download
memory/728-1209-0x00007FFDFDB90000-0x00007FFDFDD85000-memory.dmp

Filesize
2.0MB

Download
memory/1096-1237-0x0000000073850000-0x00000000739CB000-memory.dmp

Filesize
1.5MB

Download
memory/1096-1235-0x00007FFDFDB90000-0x00007FFDFDD85000-memory.dmp

Filesize
2.0MB

Download
memory/1096-1234-0x0000000073850000-0x00000000739CB000-memory.dmp

Filesize
1.5MB

Download
memory/1096-1233-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/4976-1212-0x0000000000A70000-0x0000000000CB4000-memory.dmp

Filesize
2.3MB

Download
memory/4976-1215-0x00007FFDFDB90000-0x00007FFDFDD85000-memory.dmp

Filesize
2.0MB

Download
memory/4976-1216-0x0000000000A70000-0x0000000000CB4000-memory.dmp

Filesize
2.3MB

Download
memory/4976-1221-0x0000000000A70000-0x0000000000CB4000-memory.dmp

Filesize
2.3MB

Download
memory/4976-1231-0x0000000000A70000-0x0000000000CB4000-memory.dmp

Filesize
2.3MB

Download
memory/5608-1159-0x000001D741140000-0x000001D741162000-memory.dmp

Filesize
136KB

Download
memory/6032-1207-0x0000000075300000-0x000000007547B000-memory.dmp

Filesize
1.5MB

Download
memory/6032-1206-0x00007FFDFDB90000-0x00007FFDFDD85000-memory.dmp

Filesize
2.0MB

Download
memory/6032-1205-0x0000000075300000-0x000000007547B000-memory.dmp

Filesize
1.5MB

Download
memory/6032-1204-0x00000000000A0000-0x000000000052D000-memory.dmp

Filesize
4.6MB

Download