Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1199s -
max time network
1112s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
04/05/2024, 12:14
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://delta-executor.com
Resource
win10-20240404-en
General
-
Target
http://delta-executor.com
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\Geo\Nation Delta.exe -
Executes dropped EXE 5 IoCs
pid Process 3736 Delta V3.61 b_82497757.exe 5988 setup82497757.exe 3648 setup82497757.exe 6000 OfferInstaller.exe 5976 Delta.exe -
Loads dropped DLL 64 IoCs
pid Process 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe 3648 setup82497757.exe -
Checks for any installed AV software in registry 1 TTPs 8 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV setup82497757.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir setup82497757.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV setup82497757.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version setup82497757.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast setup82497757.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version setup82497757.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast setup82497757.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir setup82497757.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 294 discord.com 295 discord.com 296 discord.com 298 discord.com 299 discord.com -
Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 3 IoCs
pid Process 4140 timeout.exe 4628 timeout.exe 5644 timeout.exe -
Enumerates processes with tasklist 1 TTPs 3 IoCs
pid Process 2632 tasklist.exe 2208 tasklist.exe 4184 tasklist.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133592985342701011" chrome.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\msn.com\Total = "101" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\MrtCache MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.msn.com MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\discord.com\NumberOfSubdomain = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\discord.com\Total = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "421590016" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4b098ab21c9eda01 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\discord.com MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4 setup82497757.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 0f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd94090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030762000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3390b000000010000001800000045006e00740072007500730074002e006e006500740000001400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab1d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d347e000000010000000800000000c001b39667d6010300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d42000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6 setup82497757.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 190000000100000010000000fa46ce7cbb85cfb4310075313a09ee050300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d47e000000010000000800000000c001b39667d6011d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d341400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab0b000000010000001800000045006e00740072007500730074002e006e0065007400000062000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3397f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b06010505070307530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd942000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6 setup82497757.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4756 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5412 chrome.exe 5412 chrome.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 5988 setup82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe -
Suspicious behavior: MapViewOfSection 12 IoCs
pid Process 2980 MicrosoftEdgeCP.exe 2980 MicrosoftEdgeCP.exe 2980 MicrosoftEdgeCP.exe 2980 MicrosoftEdgeCP.exe 2980 MicrosoftEdgeCP.exe 2980 MicrosoftEdgeCP.exe 2980 MicrosoftEdgeCP.exe 2980 MicrosoftEdgeCP.exe 2980 MicrosoftEdgeCP.exe 2980 MicrosoftEdgeCP.exe 5024 MicrosoftEdgeCP.exe 5024 MicrosoftEdgeCP.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
pid Process 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4500 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4500 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4500 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4500 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2316 MicrosoftEdge.exe Token: SeDebugPrivilege 2316 MicrosoftEdge.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe Token: SeShutdownPrivilege 5412 chrome.exe Token: SeCreatePagefilePrivilege 5412 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe -
Suspicious use of SendNotifyMessage 26 IoCs
pid Process 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe 5412 chrome.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 2316 MicrosoftEdge.exe 2980 MicrosoftEdgeCP.exe 4500 MicrosoftEdgeCP.exe 2980 MicrosoftEdgeCP.exe 2616 MicrosoftEdgeCP.exe 3736 Delta V3.61 b_82497757.exe 3736 Delta V3.61 b_82497757.exe 5988 setup82497757.exe 3324 MicrosoftEdge.exe 5024 MicrosoftEdgeCP.exe 5024 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2568 2980 MicrosoftEdgeCP.exe 78 PID 2980 wrote to memory of 2568 2980 MicrosoftEdgeCP.exe 78 PID 2980 wrote to memory of 2568 2980 MicrosoftEdgeCP.exe 78 PID 2980 wrote to memory of 2568 2980 MicrosoftEdgeCP.exe 78 PID 2980 wrote to memory of 2568 2980 MicrosoftEdgeCP.exe 78 PID 2980 wrote to memory of 2568 2980 MicrosoftEdgeCP.exe 78 PID 2980 wrote to memory of 2568 2980 MicrosoftEdgeCP.exe 78 PID 2980 wrote to memory of 2568 2980 MicrosoftEdgeCP.exe 78 PID 2980 wrote to memory of 2568 2980 MicrosoftEdgeCP.exe 78 PID 2980 wrote to memory of 2568 2980 MicrosoftEdgeCP.exe 78 PID 5412 wrote to memory of 5476 5412 chrome.exe 84 PID 5412 wrote to memory of 5476 5412 chrome.exe 84 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5664 5412 chrome.exe 86 PID 5412 wrote to memory of 5680 5412 chrome.exe 87 PID 5412 wrote to memory of 5680 5412 chrome.exe 87 PID 5412 wrote to memory of 5728 5412 chrome.exe 88 PID 5412 wrote to memory of 5728 5412 chrome.exe 88 PID 5412 wrote to memory of 5728 5412 chrome.exe 88 PID 5412 wrote to memory of 5728 5412 chrome.exe 88 PID 5412 wrote to memory of 5728 5412 chrome.exe 88 PID 5412 wrote to memory of 5728 5412 chrome.exe 88 PID 5412 wrote to memory of 5728 5412 chrome.exe 88 PID 5412 wrote to memory of 5728 5412 chrome.exe 88 PID 5412 wrote to memory of 5728 5412 chrome.exe 88 PID 5412 wrote to memory of 5728 5412 chrome.exe 88 PID 5412 wrote to memory of 5728 5412 chrome.exe 88 PID 5412 wrote to memory of 5728 5412 chrome.exe 88 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\LaunchWinApp.exe"C:\Windows\system32\LaunchWinApp.exe" "http://delta-executor.com"1⤵PID:612
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2316
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:2956
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4500
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2568
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2616
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4556
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa864c9758,0x7ffa864c9768,0x7ffa864c97782⤵PID:5476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:22⤵PID:5664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:82⤵PID:5680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2068 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:82⤵PID:5728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2896 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:12⤵PID:5780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2904 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:12⤵PID:5800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3972 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:12⤵PID:6136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4588 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:82⤵PID:4352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4624 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:82⤵PID:1936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:82⤵PID:3144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:82⤵PID:1116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4624 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:82⤵PID:2100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5040 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:12⤵PID:5136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5052 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:12⤵PID:5220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3340 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:12⤵PID:4804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3568 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:12⤵PID:1248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:82⤵PID:2644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3400 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:12⤵PID:2688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4888 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:12⤵PID:1876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4956 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:12⤵PID:32
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=3320 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:12⤵PID:2192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5352 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:12⤵PID:784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5544 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:12⤵PID:4540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2380 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:82⤵PID:5340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5452 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:12⤵PID:4980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5744 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:12⤵PID:4768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:82⤵PID:4532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6180 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:82⤵PID:844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6220 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:82⤵PID:3468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:82⤵PID:1296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5920 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:82⤵PID:5028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6160 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:82⤵PID:4528
-
-
C:\Users\Admin\Downloads\Delta V3.61 b_82497757.exe"C:\Users\Admin\Downloads\Delta V3.61 b_82497757.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3736 -
C:\Users\Admin\AppData\Local\setup82497757.exeC:\Users\Admin\AppData\Local\setup82497757.exe hhwnd=459030 hreturntoinstaller hextras=id:d8d090d10951db6-AU-KA1rz3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe"C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe"4⤵
- Executes dropped EXE
PID:6000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""5⤵PID:5436
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "PID eq 6000" /fo csv6⤵
- Enumerates processes with tasklist
PID:4184
-
-
C:\Windows\SysWOW64\find.exefind /I "6000"6⤵PID:380
-
-
C:\Windows\SysWOW64\timeout.exetimeout 16⤵
- Delays execution with timeout.exe
PID:4628
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "PID eq 6000" /fo csv6⤵
- Enumerates processes with tasklist
PID:2632
-
-
C:\Windows\SysWOW64\find.exefind /I "6000"6⤵PID:5712
-
-
C:\Windows\SysWOW64\timeout.exetimeout 56⤵
- Delays execution with timeout.exe
PID:5644
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""4⤵PID:4312
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "PID eq 5988" /fo csv5⤵
- Enumerates processes with tasklist
PID:2208
-
-
C:\Windows\SysWOW64\find.exefind /I "5988"5⤵PID:5224
-
-
C:\Windows\SysWOW64\timeout.exetimeout 55⤵
- Delays execution with timeout.exe
PID:4140
-
-
-
-
C:\Users\Admin\AppData\Local\setup82497757.exeC:\Users\Admin\AppData\Local\setup82497757.exe hready3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3648
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt3⤵
- Opens file in notepad (likely ransom note)
PID:4756
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=5608 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:12⤵PID:1924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=6272 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:12⤵PID:5236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6624 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:82⤵PID:3612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6768 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:82⤵PID:4228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=4708 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:12⤵PID:5004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6524 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:82⤵PID:1244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6992 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:22⤵PID:4164
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:6064
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4181⤵PID:4188
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap32165:80:7zEvent188701⤵PID:5184
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4272
-
C:\Users\Admin\Desktop\Delta V3.61\Delta.exe"C:\Users\Admin\Desktop\Delta V3.61\Delta.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5976
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3324
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:4676
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5024
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2784
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5072
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d2e7bad999f306c2b3883a9d51a1aeca
SHA14edbcb14a59f3792f9268378ad3b9485856139bb
SHA2569560bd65c420c5a9037d0f95a0e3b70d2938e6f9c7436481387ef897d792eb1d
SHA51236c8055a498cace0836326a0761e96b1fc7287e63ea1fe9ad5923466b01522223a6f0f4e25a79daa1fc34da7fd68e7e5f6c2d4f469cd6dd9c6a23088e837826c
-
Filesize
1KB
MD50fa0ed2fb08708ec134749e861a893e2
SHA1fc0b86cebeb1c605dacccd4095890433e4dfe156
SHA25667f302d72125037f3f2f8cdcea2ce858539851902232ad468fb819a7380e3e37
SHA5127866b0d038ca5f19a234c4d6fe8d2484639ce57efb2400c15f1e962b42efb5bfb92686a4365918cee682d68501859c7392237128b412d5528b0afd958a8a4c16
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9ceec8e0-eaa0-4f3e-a9e1-9a6bd0974285.tmp
Filesize1020B
MD509d67129af6faf92a2a926d9c4716e87
SHA174de08ff453e002eb169fa2d639175ca25c0b40b
SHA256b142ad580dbb4ef4e7cca9dcb1ffd40460218992d9aa43f7fffac592474a4b45
SHA51220db68453e99484e0211202f1a4b642ce6177a565b77ef9439c62dd09fbd282bcc9ba0df575228585b67788c93a79a1acaa642b8279c78ec787637f8bdac4235
-
Filesize
8KB
MD5fde3406c9798a3d2ab62fc2758e0d8ab
SHA1b8b0230c4a7884e1d923192ba58b9ca6d705fb0a
SHA2568b5b757e39758402ec3cc4dddc1d5d21b3b36e479e1672abc25d5b9fb9066488
SHA51219e90e7890da2d834b898199ef5d871b8a130dd56fd8a60833445fcb30e3d4d4d38cfd90e25e13550f2ea97681096abcace46315ef2566442e9b0b35d97f3fe1
-
Filesize
9KB
MD51820b1f663f54a80b969a0f251cfea4c
SHA1c51e4c5201bce6d055aebe4286a54b9fc0a70138
SHA256007fc9ea68ebc2070f5005064be779dcb41115479a18ef315971fc801ccb04c5
SHA512e0a6e2a9e21d543f4f497accdf502398c4d5621d7e214c7731c3237026c0f5b5d91b74193d3b887957c796eeb1ad30a37b757ac7d005bd1023d4e2e1b764be05
-
Filesize
1018B
MD53acb107b76d815f27bb173d93776144f
SHA16f30406bce666dffbad12655808b7c67e82a4e06
SHA256d57564db706bc52db016201e03f69f3055d903da6bff61cd2184b45922c4a2d3
SHA5129bc3ef79b37aae277ee39305bf949f87d8c27c56d44c290b8e78f420c16c72f4058b5780f89f0c4547b7264e5a4ccaf6ec8f48ac3335ff962c7e972aae685a30
-
Filesize
1018B
MD55aba602098e7e4b3cfeb7cd4612e9e9d
SHA136fddbd0a34bb23f78a7aee1e1320692d00c924a
SHA2568055144abcbb958550fe4dc6adf486b76fcb22926343647c1e3773a26b4ed6c7
SHA512d31ec1ad488c2bae24bb58dd9b617b1338f5aae96f7ac94837c3c91ca2d11ed03bd51baff53f2b21af283302ee4e3d6cc3ab881b04c5037e70224f9cb281c87d
-
Filesize
7KB
MD51e17214b54e95f63c7c34488372692e6
SHA18ac6b442823d1753c89b734e874671b9abb3eebb
SHA256f6beb6616e783e8a62754246a2e43aa465503a19238a2339a974396b208d0a7c
SHA512e7da1276bbbfbcbfe63018d8ef56a74718c2a1d388d5c95c9b998d1e23a9e2d853cfe45683948f6e6e660b6056ca73213cfac5448514d62827c4821cd6f178fc
-
Filesize
9KB
MD557259c49b0cd24f741e65d89491fd216
SHA10a41117b74939108811d91c616bf7e71a9eeb74a
SHA25638216d2cd613013f55c2506818be7780704527470f5c5b72bf3ab9735599c769
SHA51263d4e98e7507ce4fe1fda966da72c8e03e24175d8abba31338d5bb2512da0601fcb82106806e8c5fe044b238699eb694e04366de1026d9796a42ca1d11bb433f
-
Filesize
1020B
MD5a982d1bd4610693076ff8251466933fa
SHA174404e9153a4795bd63fcc3d40bafe39dbb238bc
SHA256fd76058625a016b0d1a4eabbcbe2264d9b2c1441be2d6df00a172e1f79b24b67
SHA5125c8df6f7ec6cdc99315a2d70d09e614277bd05c6480dd3b4a29c81dc4c65811c902e72b2597f146720653c9d473f3abb854e2c68aaaf846697c30fd23de137da
-
Filesize
1KB
MD516c15004268eb3e4e7dd85f92e906f43
SHA190c8fea5dd4344a2c1a91b5f887c8919728bd314
SHA256d2c913e065fbed8b9e63d6e995d98ee66894937dd9bee62e50bd99ce20ff52cf
SHA5121d7520ee2725230b49b91ab3534a3561388cc35673aed6f8125540528c105b5c8cc17d60baccb7ea4a717d652fd34ead994786be932b54b07423d6b8b2845c12
-
Filesize
367B
MD5f5844272d6c6ff0a47bfa4341539331b
SHA111fae0609ed908adc9ff074f0f5fea79d915f554
SHA256476858d068993cb7dbdccc598b412db422b8b87e0a892e666276f638684b451b
SHA512550f39916c1fda00e55226aa8e5d366b578399fef34227f180a5ca73e586799c7bdf005fa3d4f4ce2cc071eec2f67b3a1aaad3d87e181d6b48fce0088ab8aaf6
-
Filesize
1020B
MD5f91bbcc8b1629bc6e4543a2d25e330bf
SHA1a2ef73a98ca173796d137e0521ccc5ce7e467b46
SHA2561e24f991a39c53ca8156e01c82a7caf1d7df6e6c6d8324a6d1629ca4f233d5ab
SHA512efb1cf3047d8a929555b273659912326557161f7ef6c2f0b30f8bc906a6b529aef31707da01cdb853b0e4adb9d951b64cb4a86997b2ffd7ce3d46ef95d3acb18
-
Filesize
6KB
MD510cacfc3703988d5e120cd233ba38df3
SHA1fb90c3130c362c98199b3582e52a95d89071d7d2
SHA256ac69ba9c08482f17830e37d3efe288469bdbdd994686ed68005f7392b0061e00
SHA512bad0d66fb13bf9d7541f5ca65a84e6b60e9c55876263648f050f618fcf4c00c22076f7c4a97eb0235bc2b060bd9fac6e44202cf621e10c9cd58d2e1cc233f0d7
-
Filesize
6KB
MD5cbc949fab88b1d63caf64ef93a7bd225
SHA185ecea04475b2046962a585e04eb7b90ce5cd8c7
SHA2564aa3a57ea337fb0555db7cb7434cc6bb305f364820ef3ff54a398b54600e5bd5
SHA5129f210c818a91dceb79099f83f9aa66d9ce6bb9b7f862d098226383cfbc55f24f2590dbcd8c75650858c3f08fbd04e2172df8acefb24e0a76e2de1246c537e91f
-
Filesize
6KB
MD5dd0d70eaa081cf365918be333e805471
SHA130e6cce693365c24f5a46ee1d8d9441c3c72e9f7
SHA2561b491a8c033748902e8245958d7746741c03409323d505962154f2b1278f3f2c
SHA5123aa5b84b0cfc9c3cb1c825e4bb3ada6993c6ebae11570023461a30510080008659f7557a8f0a68efc1aa31ab8f3c80b793cec9f35736d2b8ede929b6314b42af
-
Filesize
6KB
MD51b3b08633ef7459f42cfd004ac3c8402
SHA148d00cd7d40a24061dc82069f5f2c894108f3419
SHA256dc7394f5feefde6ec985ce46fc4ba98cd318c4c527f4652320fd144667de2a66
SHA512e64e8597d1669a4f1cbd72aa3030c3f267c4d3af838e4601ea7432733c671e42121687f8a280434bc823a630af7500f712f06f8ce6a6b6363ed708a5b4d348b7
-
Filesize
6KB
MD56b6ace1511648d05b2fa1ff068b545b5
SHA17b3b53df709d806cbedcce4b425aff22afdfe32e
SHA256f5f6350ee9617163cf83c68cca472f2e315dc3278e36d3b5afe142bca8926275
SHA512b836f4bb9ebd5b01f156c30b468a6a0b87db96f10dc4c87f6d93f1dd569c764694f05d7e34a8f8ca39221c1f342fe88a12060b6432cba8b206fe273b3f2a44da
-
Filesize
5KB
MD5921f235f44378c0ca824dc82b69050e0
SHA11fe3996f3ee0903d38dfa69fe059e205d5fe29ab
SHA2565f583bd5860460003b3b1b74ec0e5a789c9bdaa8a5aec09ff6058542ff1c065e
SHA512bc00438aae0c47ad6431717d7c9cf6d605467046ffa689626ff74e19bb6bbc8328c2fcaf7852232919c157b8cb906518b91310614db1fbd13b6f6103dc87c6ca
-
Filesize
12KB
MD5c19151d8b0b6ca35548716c945d6945c
SHA1a2f5360a62e45a4784a186143db22cf2280b5573
SHA2563badcc95ce6200566a8a9e5724ad0c086ed0198d3ff02721892ae2e41d23eb69
SHA5121aedc6720aec24242706f9ac0e5c73220a9bf1b0324a121b715751b2be7b2bfa580d132395c1caaeabe6da875b165a7fb7b4238e843ca493b5d864f78d27910d
-
Filesize
272KB
MD587596e7c389ec372fd6db63e78485958
SHA14e2645dddd236389d8e0786c96cd9225a96f543e
SHA256abdaadb717f3b255bf7e6ad92b9ccccde6f7ded370ca36e2d38e8b45522c71f9
SHA512bd418b4a985464adcdebded73071aea710ea676d757ebae95c3355272184b66e1b5d6fba7002493002eeff71ad3598ed16dd59581bd7b0d163952cc4927f8f4b
-
Filesize
272KB
MD53f05eca364f1e7142c351cb33c377978
SHA188a73498f951bb7d55a52d206129a3a7c407ce6a
SHA256853f15edf98cb31ab31776d4639fb9d6c8958df93401d99e49a6e58702d934cd
SHA51272e5ab4ce24443f3fb366ce389919167b99764eb1cb3d0453afe9d8e73693f33fe857c0b3a268b33ff0b93602610714ab1e207da994ad4e99c1f6f9a31deb189
-
Filesize
99KB
MD5623e4fc24aee5e13f45952247c1961e0
SHA141387d92228a9df582765837a160c32836d004b5
SHA256da7ee83cc5f32c6a6c49512165fd507ed142a08a350427110871861982fbbf40
SHA5128015a244b03205429574d43363dde8c4cd481b9812f358fe539029716eae76dff79473ba8e306a802721924860c745616d3f3e7ba12187d37acf762155c110e3
-
Filesize
113KB
MD5f07300d126c9b6b973f85cfddcd85c06
SHA19f058b3ecf6da97dfffc3a1f9ecee96b80cfe5a8
SHA25627e4b8c1c7b7a6a69d5515d977c5607074eecd3f30f6a671ec63a4bbcf6121ec
SHA512aef6304fbe4e57ba6ffd000a59ea23bd487db55eb1a2a8298eb35d38c5a354ce7f5c7a23ccf31548da3145e1c695ebcbaa0e5cff2f6d7b357d01f247d1ca0e01
-
Filesize
92KB
MD567ce82dadf0b3e9fdeb87195f767b031
SHA18ac99701c874af3bb84e29a5b9f778f44381e238
SHA2565ddd4126489874cad7c521f9dccbe77305dbff2d7989c565faa130943c992464
SHA512b67bbc3fa5b43f93a369814b11cfd8af81dd6cf48ab3a456aeff4196d1b5354959888656d04fff102c04017ea97420cdfaf21f081a0d03e9d87d78f6fb161cd1
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize4KB
MD51bfe591a4fe3d91b03cdf26eaacd8f89
SHA1719c37c320f518ac168c86723724891950911cea
SHA2569cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
SHA51202f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\C7ND021V\favicon[1].ico
Filesize23KB
MD5ec2c34cadd4b5f4594415127380a85e6
SHA1e7e129270da0153510ef04a148d08702b980b679
SHA256128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7
SHA512c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\PBYWKLPY\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF8E90E3EB5C845E48.TMP
Filesize24KB
MD5b1a056de706c547804d20a2a7977db1e
SHA1396e1a710a5d18eb24f499e22eadfec13c48b43b
SHA256748c484e2440234e6a0b84aaedeec5db72e9eac4b87496a207a6dc1e6a8cdf46
SHA512e268893ea2aafe6a07e4556ddeb7bc26ac9cac78cef3c6653e132f3ec2226b9d173edd15c1c7bc0fafa881697655b5484bb74e38019f0a42f5df71b4a0f8c888
-
Filesize
5.7MB
MD538cc1b5c2a4c510b8d4930a3821d7e0b
SHA1f06d1d695012ace0aef7a45e340b70981ca023ba
SHA256c2ba8645c5c9507d422961ceaeaf422adf6d378c2a7c02199ed760fb37a727f2
SHA51299170f8094f61109d08a6e7cf25e7fba49160b0009277d10e9f0b9dac6f022e7a52e3d822e9aee3f736c2d285c4c3f62a2e6eb3e70f827ac6e8b867eea77f298
-
Filesize
19KB
MD5554c3e1d68c8b5d04ca7a2264ca44e71
SHA1ef749e325f52179e6875e9b2dd397bee2ca41bb4
SHA2561eb0795b1928f6b0459199dace5affdc0842b6fba87be53ca108661275df2f3e
SHA51258ce13c47e0daf99d66af1ea35984344c0bb11ba70fe92bc4ffa4cd6799d6f13bcad652b6883c0e32c6e155e9c1b020319c90da87cb0830f963639d53a51f9c6
-
Filesize
168KB
MD528f1996059e79df241388bd9f89cf0b1
SHA16ad6f7cde374686a42d9c0fcebadaf00adf21c76
SHA256c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce
SHA5129654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29
-
Filesize
541KB
MD59de86cdf74a30602d6baa7affc8c4a0f
SHA19c79b6fbf85b8b87dd781b20fc38ba2ac0664143
SHA25656032ade45ccf8f4c259a2e57487124cf448a90bca2eeb430da2722d9e109583
SHA512dca0f6078df789bb8c61ffb095d78f564bfc3223c6795ec88aeb5f132c014c5e3cb1bd8268f1e5dc96d7302c7f3de97e73807f3583cb4a320d7adbe93f432641
-
Filesize
1KB
MD59ba0a91b564e22c876e58a8a5921b528
SHA18eb23cab5effc0d0df63120a4dbad3cffcac6f1e
SHA2562ad742b544e72c245f4e9c2e69f989486222477c7eb06e85d28492bd93040941
SHA51238b5fb0f12887a619facce82779cb66e2592e5922d883b9dc4d5f9d2cb12e0f84324422cd881c948f430575febd510e948a22cd291595e3a0ba0307fce73bec9
-
Filesize
291B
MD5bf5328e51e8ab1211c509b5a65ab9972
SHA1480dfb920e926d81bce67113576781815fbd1ea4
SHA25698f22fb45530506548ae320c32ee4939d27017481d2ad0d784aa5516f939545b
SHA51292bd7895c5ff8c40eecfdc2325ee5d1fb7ed86ce0ef04e8e4a65714fcf5603ea0c87b71afadb473433abb24f040ccabd960fa847b885322ad9771e304b661928
-
Filesize
766B
MD54003efa6e7d44e2cbd3d7486e2e0451a
SHA1a2a9ab4a88cd4732647faa37bbdf726fd885ea1e
SHA256effd42c5e471ea3792f12538bf7c982a5cda4d25bfbffaf51eed7e09035f4508
SHA51286e71ca8ca3e62949b44cfbc7ffa61d97b6d709fc38216f937a026fb668fbb1f515bac2f25629181a82e3521dafa576cac959d2b527d9cc9eb395e50d64c1198
-
Filesize
3.8MB
MD529d3a70cec060614e1691e64162a6c1e
SHA1ce4daf2b1d39a1a881635b393450e435bfb7f7d1
SHA256cc70b093a19610e9752794d757aec9ef07ca862ea9267ec6f9cc92b2aa882c72
SHA51269d07437714259536373872e8b086fc4548f586e389f67e50f56d343e980546f92b8a13f28c853fc1daf187261087a9dceb33769ba2031c42382742d86c60e4b
-
Filesize
9.5MB
MD51198daaa23f0af650c7cd4555fbef9e8
SHA1783f86460785027a41a84e41b42a05b4d4a1a462
SHA25625c846183e10bd2a146325effecddbabf0f390717fd11d597012a033e6daf600
SHA5121a67d52794c2047936fc4814b70dd6474837b90df7a8b5653eb8a09cf98d4df2c93fb07451a29254e2e161e9e3f0c3f87e9f5e1252a2c89f2b7f95537e80227d
-
Filesize
57KB
MD56e001f8d0ee4f09a6673a9e8168836b6
SHA1334ad3cf0e4e3c03415a4907b2d6cf7ba4cbcd38
SHA2566a30f9c604c4012d1d2e1ba075213c378afb1bfcb94276de7995ed7bbf492859
SHA5120eff2e6d3ad75abf801c2ab48b62bc93ebc5a128d2e03e507e6e5665ff9a2ab58a9d82ca71195073b971f8c473f339baffdd23694084eaaff321331b5faaecf6
-
Filesize
117KB
MD508112f27dcd8f1d779231a7a3e944cb1
SHA139a98a95feb1b6295ad762e22aa47854f57c226f
SHA25611c6a8470a3f2b2be9b8cafe5f9a0afce7303bfd02ab783a0f0ee09a184649fa
SHA512afd0c7df58b63c7cfdbedea7169a1617f2ac4bad07347f8ed7757a25ab0719489d93272109b73a1b53e9c5997dedad8da89da7b339d30fc2573ca2f76c630ddb
-
Filesize
15KB
MD5422be1a0c08185b107050fcf32f8fa40
SHA1c8746a8dad7b4bf18380207b0c7c848362567a92
SHA256723aea78755292d2f4f87ad100a99b37bef951b6b40b62e2e2bbd4df3346d528
SHA512dff51c890cb395665839070d37170d321dc0800981a42f173c6ea570684460146b4936af9d8567a6089bef3a7802ac4931c14031827689ef345ea384ceb47599
-
Filesize
75KB
MD5c06ac6dcfa7780cd781fc9af269e33c0
SHA1f6b69337b369df50427f6d5968eb75b6283c199d
SHA256b23b8310265c14d7e530b80defc6d39cdc638c07d07cd2668e387863c463741d
SHA512ad167ad62913243e97efaeaa7bad38714aba7fc11f48001974d4f9c68615e9bdfb83bf623388008e77d61cee0eaba55ce47ebbb1f378d89067e74a05a11d9fe3
-
Filesize
160KB
MD56df226bda27d26ce4523b80dbf57a9ea
SHA1615f9aba84856026460dc54b581711dad63da469
SHA25617d737175d50eee97ac1c77db415fe25cc3c7a3871b65b93cc3fad63808a9abc
SHA512988961d7a95c9883a9a1732d0b5d4443c790c38e342a9e996b072b41d2e8686389f36a249f2232cb58d72f8396c849e9cc52285f35071942bec5c3754b213dd5
-
Filesize
119KB
MD59d2c520bfa294a6aa0c5cbc6d87caeec
SHA120b390db533153e4bf84f3d17225384b924b391f
SHA256669c812cb8f09799083014a199b0deee10237c95fb49ee107376b952fee5bd89
SHA5127e2e569549edb6ddd2b0cb0012386aed1f069e35d1f3045bb57704ef17b97129deb7cde8e23bc49980e908e1a5a90b739f68f36a1d231b1302a5d29b722e7c15
-
Filesize
8KB
MD5be4c2b0862d2fc399c393fca163094df
SHA17c03c84b2871c27fa0f1914825e504a090c2a550
SHA256c202e4f92b792d34cb6859361aebdbfc8c61cf9e735edfd95e825839920fb88a
SHA512d9c531687a5051bbfe5050c5088623b3fd5f20b1e53dd4d3ed281c8769c15f45da36620231f6d0d76f8e2aa7de00c2324a4bf35a815cefc70ca97bc4ab253799
-
Filesize
154KB
MD517220f65bd242b6a491423d5bb7940c1
SHA1a33fabf2b788e80f0f7f84524fe3ed9b797be7ad
SHA25623056f14edb6e0afc70224d65de272a710b5d26e6c3b9fe2dfd022073050c59f
SHA512bfbe284a2ee7361ada9a9cb192580fd64476e70bc78d14e80ad1266f7722a244d890600cf24bfb83d4914e2434272679ba177ee5f98c709950e43192f05e215e
-
Filesize
56KB
MD5f931e960cc4ed0d2f392376525ff44db
SHA11895aaa8f5b8314d8a4c5938d1405775d3837109
SHA2561c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870
SHA5127fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0
-
Filesize
133KB
MD58db691813a26e7d0f1db5e2f4d0d05e3
SHA17c7a33553dd0b50b78bf0ca6974c77088da253eb
SHA2563043a65f11ac204e65bca142ff4166d85f1b22078b126b806f1fecb2a315c701
SHA512d02458180ec6e6eda89b5b0e387510ab2fad80f9ce57b8da548aaf85c34a59c39afaeacd1947bd5eb81bee1f6d612ca57d0b2b756d64098dfc96ca0bf2d9f62f
-
Filesize
172KB
MD5b199dcd6824a02522a4d29a69ab65058
SHA1f9c7f8c5c6543b80fa6f1940402430b37fa8dce4
SHA2569310a58f26be8bd453cde5ca6aa05042942832711fbdeb5430a2840232bfa5e4
SHA5121d3e85e13ff24640c76848981ca84bafb32f819a082e390cb06fe13445814f50f8e3fc3a8a8e962aae8867e199c1517d570c07f28d5f7e5f007b2bb6e664ddb1
-
Filesize
134KB
MD5105a9e404f7ac841c46380063cc27f50
SHA1ec27d9e1c3b546848324096283797a8644516ee3
SHA25669fe749457218ec9a765f9aac74caf6d4f73084cf5175d3fd1e4f345af8b3b8b
SHA5126990cbfc90c63962abde4fdaae321386f768be9fcf4d08bccd760d55aba85199f7a3e18bd7abe23c3a8d20ea9807cecaffb4e83237633663a8bb63dd9292d940
-
Filesize
101KB
MD583d37fb4f754c7f4e41605ec3c8608ea
SHA170401de8ce89f809c6e601834d48768c0d65159f
SHA25656db33c0962b3c34cba5279d2441bc4c12f28b569eadc1b3885dd0951b2c4020
SHA512f5f3479f485b1829bbfb7eb8087353aee569184f9c506af15c4e28bfe4f73bf2cc220d817f6dfc34b2a7a6f69453f0b71e64b79c4d500ff9a243799f68e88b9f
-
Filesize
151KB
MD572990c7e32ee6c811ea3d2ea64523234
SHA1a7fcbf83ec6eefb2235d40f51d0d6172d364b822
SHA256e77e0b4f2762f76a3eaaadf5a3138a35ec06ece80edc4b3396de7a601f8da1b3
SHA5122908b8c387d46b6329f027bc1e21a230e5b5c32460f8667db32746bc5f12f86927faa10866961cb2c45f6d594941f6828f9078ae7209a27053f6d11586fd2682
-
Filesize
426KB
MD58ff1898897f3f4391803c7253366a87b
SHA19bdbeed8f75a892b6b630ef9e634667f4c620fa0
SHA25651398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad
SHA512cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03
-
Filesize
74KB
MD51a84957b6e681fca057160cd04e26b27
SHA18d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe
SHA2569faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5
SHA5125f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa