hxxp://delta-executor[.]com

Analysis

max time kernel
1199s
max time network
1112s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
04/05/2024, 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://delta-executor.com

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\Geo\Nation	Delta.exe

Executes dropped EXE 5 IoCs

pid	Process
3736	Delta V3.61 b_82497757.exe
5988	setup82497757.exe
3648	setup82497757.exe
6000	OfferInstaller.exe
5976	Delta.exe

Loads dropped DLL 64 IoCs

pid	Process
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe
3648	setup82497757.exe

Checks for any installed AV software in registry 1 TTPs 8 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV	setup82497757.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	setup82497757.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV	setup82497757.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version	setup82497757.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	setup82497757.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version	setup82497757.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	setup82497757.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	setup82497757.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
294	discord.com
295	discord.com
296	discord.com
298	discord.com
299	discord.com

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
4140	timeout.exe
4628	timeout.exe
5644	timeout.exe

Enumerates processes with tasklist 1 TTPs 3 IoCs

Process Discovery

T1057

pid	Process
2632	tasklist.exe
2208	tasklist.exe
4184	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133592985342701011"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\msn.com\Total = "101"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\MrtCache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.msn.com	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\discord.com\NumberOfSubdomain = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\discord.com\Total = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "421590016"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4b098ab21c9eda01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\discord.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4	setup82497757.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 0f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd94090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030762000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3390b000000010000001800000045006e00740072007500730074002e006e006500740000001400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab1d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d347e000000010000000800000000c001b39667d6010300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d42000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	setup82497757.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 190000000100000010000000fa46ce7cbb85cfb4310075313a09ee050300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d47e000000010000000800000000c001b39667d6011d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d341400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab0b000000010000001800000045006e00740072007500730074002e006e0065007400000062000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3397f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b06010505070307530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd942000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	setup82497757.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4756	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5412	chrome.exe
5412	chrome.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
5988	setup82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe

Suspicious behavior: MapViewOfSection 12 IoCs

pid	Process
2980	MicrosoftEdgeCP.exe
2980	MicrosoftEdgeCP.exe
2980	MicrosoftEdgeCP.exe
2980	MicrosoftEdgeCP.exe
2980	MicrosoftEdgeCP.exe
2980	MicrosoftEdgeCP.exe
2980	MicrosoftEdgeCP.exe
2980	MicrosoftEdgeCP.exe
2980	MicrosoftEdgeCP.exe
2980	MicrosoftEdgeCP.exe
5024	MicrosoftEdgeCP.exe
5024	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4500	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4500	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4500	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4500	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2316	MicrosoftEdge.exe
Token: SeDebugPrivilege	2316	MicrosoftEdge.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe
Token: SeShutdownPrivilege	5412	chrome.exe
Token: SeCreatePagefilePrivilege	5412	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe
5412	chrome.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2316	MicrosoftEdge.exe
2980	MicrosoftEdgeCP.exe
4500	MicrosoftEdgeCP.exe
2980	MicrosoftEdgeCP.exe
2616	MicrosoftEdgeCP.exe
3736	Delta V3.61 b_82497757.exe
3736	Delta V3.61 b_82497757.exe
5988	setup82497757.exe
3324	MicrosoftEdge.exe
5024	MicrosoftEdgeCP.exe
5024	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2568	2980	MicrosoftEdgeCP.exe	78
PID 2980 wrote to memory of 2568	2980	MicrosoftEdgeCP.exe	78
PID 2980 wrote to memory of 2568	2980	MicrosoftEdgeCP.exe	78
PID 2980 wrote to memory of 2568	2980	MicrosoftEdgeCP.exe	78
PID 2980 wrote to memory of 2568	2980	MicrosoftEdgeCP.exe	78
PID 2980 wrote to memory of 2568	2980	MicrosoftEdgeCP.exe	78
PID 2980 wrote to memory of 2568	2980	MicrosoftEdgeCP.exe	78
PID 2980 wrote to memory of 2568	2980	MicrosoftEdgeCP.exe	78
PID 2980 wrote to memory of 2568	2980	MicrosoftEdgeCP.exe	78
PID 2980 wrote to memory of 2568	2980	MicrosoftEdgeCP.exe	78
PID 5412 wrote to memory of 5476	5412	chrome.exe	84
PID 5412 wrote to memory of 5476	5412	chrome.exe	84
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5664	5412	chrome.exe	86
PID 5412 wrote to memory of 5680	5412	chrome.exe	87
PID 5412 wrote to memory of 5680	5412	chrome.exe	87
PID 5412 wrote to memory of 5728	5412	chrome.exe	88
PID 5412 wrote to memory of 5728	5412	chrome.exe	88
PID 5412 wrote to memory of 5728	5412	chrome.exe	88
PID 5412 wrote to memory of 5728	5412	chrome.exe	88
PID 5412 wrote to memory of 5728	5412	chrome.exe	88
PID 5412 wrote to memory of 5728	5412	chrome.exe	88
PID 5412 wrote to memory of 5728	5412	chrome.exe	88
PID 5412 wrote to memory of 5728	5412	chrome.exe	88
PID 5412 wrote to memory of 5728	5412	chrome.exe	88
PID 5412 wrote to memory of 5728	5412	chrome.exe	88
PID 5412 wrote to memory of 5728	5412	chrome.exe	88
PID 5412 wrote to memory of 5728	5412	chrome.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "http://delta-executor.com"
1⤵
PID:612

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2316

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2956

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4500

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2568

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2616

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4556

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa864c9758,0x7ffa864c9768,0x7ffa864c9778
  2⤵
  PID:5476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:2
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
  2⤵
  PID:5680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2068 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
  2⤵
  PID:5728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2896 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2904 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3972 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4588 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4624 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4624 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5040 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5052 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3340 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3568 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3400 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4888 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4956 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
  2⤵
  PID:32
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=3320 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5352 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
  2⤵
  PID:784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5544 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2380 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
  2⤵
  PID:5340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5452 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5744 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6180 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
  2⤵
  PID:844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6220 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5920 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6160 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
  2⤵
  PID:4528
- C:\Users\Admin\Downloads\Delta V3.61 b_82497757.exe
  "C:\Users\Admin\Downloads\Delta V3.61 b_82497757.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3736
- - C:\Users\Admin\AppData\Local\setup82497757.exe
    C:\Users\Admin\AppData\Local\setup82497757.exe hhwnd=459030 hreturntoinstaller hextras=id:d8d090d10951db6-AU-KA1rz
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks for any installed AV software in registry
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe"
      4⤵
      Executes dropped EXE
      PID:6000
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""
        5⤵
        
        PID:5436
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "PID eq 6000" /fo csv
        6⤵
        Enumerates processes with tasklist
        
        PID:4184
      - C:\Windows\SysWOW64\find.exe
        
        find /I "6000"
        6⤵
        
        PID:380
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        6⤵
        Delays execution with timeout.exe
        
        PID:4628
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "PID eq 6000" /fo csv
        6⤵
        Enumerates processes with tasklist
        
        PID:2632
      - C:\Windows\SysWOW64\find.exe
        
        find /I "6000"
        6⤵
        
        PID:5712
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 5
        6⤵
        Delays execution with timeout.exe
        
        PID:5644
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""
      4⤵
      PID:4312
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "PID eq 5988" /fo csv
        5⤵
        Enumerates processes with tasklist
        
        PID:2208
    - - C:\Windows\SysWOW64\find.exe
        
        find /I "5988"
        5⤵
        
        PID:5224
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 5
        5⤵
        Delays execution with timeout.exe
        
        PID:4140
- - C:\Users\Admin\AppData\Local\setup82497757.exe
    C:\Users\Admin\AppData\Local\setup82497757.exe hready
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3648
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=5608 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=6272 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6624 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6768 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=4708 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6524 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6992 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:2
  2⤵
  PID:4164

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:6064

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x418
1⤵
PID:4188

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap32165:80:7zEvent18870
1⤵
PID:5184

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4272

C:\Users\Admin\Desktop\Delta V3.61\Delta.exe
"C:\Users\Admin\Desktop\Delta V3.61\Delta.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5976

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3324

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4676

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5024

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2784

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
d2e7bad999f306c2b3883a9d51a1aeca

SHA1
4edbcb14a59f3792f9268378ad3b9485856139bb

SHA256
9560bd65c420c5a9037d0f95a0e3b70d2938e6f9c7436481387ef897d792eb1d

SHA512
36c8055a498cace0836326a0761e96b1fc7287e63ea1fe9ad5923466b01522223a6f0f4e25a79daa1fc34da7fd68e7e5f6c2d4f469cd6dd9c6a23088e837826c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0fa0ed2fb08708ec134749e861a893e2

SHA1
fc0b86cebeb1c605dacccd4095890433e4dfe156

SHA256
67f302d72125037f3f2f8cdcea2ce858539851902232ad468fb819a7380e3e37

SHA512
7866b0d038ca5f19a234c4d6fe8d2484639ce57efb2400c15f1e962b42efb5bfb92686a4365918cee682d68501859c7392237128b412d5528b0afd958a8a4c16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9ceec8e0-eaa0-4f3e-a9e1-9a6bd0974285.tmp

Filesize
1020B

MD5
09d67129af6faf92a2a926d9c4716e87

SHA1
74de08ff453e002eb169fa2d639175ca25c0b40b

SHA256
b142ad580dbb4ef4e7cca9dcb1ffd40460218992d9aa43f7fffac592474a4b45

SHA512
20db68453e99484e0211202f1a4b642ce6177a565b77ef9439c62dd09fbd282bcc9ba0df575228585b67788c93a79a1acaa642b8279c78ec787637f8bdac4235

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
fde3406c9798a3d2ab62fc2758e0d8ab

SHA1
b8b0230c4a7884e1d923192ba58b9ca6d705fb0a

SHA256
8b5b757e39758402ec3cc4dddc1d5d21b3b36e479e1672abc25d5b9fb9066488

SHA512
19e90e7890da2d834b898199ef5d871b8a130dd56fd8a60833445fcb30e3d4d4d38cfd90e25e13550f2ea97681096abcace46315ef2566442e9b0b35d97f3fe1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
1820b1f663f54a80b969a0f251cfea4c

SHA1
c51e4c5201bce6d055aebe4286a54b9fc0a70138

SHA256
007fc9ea68ebc2070f5005064be779dcb41115479a18ef315971fc801ccb04c5

SHA512
e0a6e2a9e21d543f4f497accdf502398c4d5621d7e214c7731c3237026c0f5b5d91b74193d3b887957c796eeb1ad30a37b757ac7d005bd1023d4e2e1b764be05

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1018B

MD5
3acb107b76d815f27bb173d93776144f

SHA1
6f30406bce666dffbad12655808b7c67e82a4e06

SHA256
d57564db706bc52db016201e03f69f3055d903da6bff61cd2184b45922c4a2d3

SHA512
9bc3ef79b37aae277ee39305bf949f87d8c27c56d44c290b8e78f420c16c72f4058b5780f89f0c4547b7264e5a4ccaf6ec8f48ac3335ff962c7e972aae685a30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1018B

MD5
5aba602098e7e4b3cfeb7cd4612e9e9d

SHA1
36fddbd0a34bb23f78a7aee1e1320692d00c924a

SHA256
8055144abcbb958550fe4dc6adf486b76fcb22926343647c1e3773a26b4ed6c7

SHA512
d31ec1ad488c2bae24bb58dd9b617b1338f5aae96f7ac94837c3c91ca2d11ed03bd51baff53f2b21af283302ee4e3d6cc3ab881b04c5037e70224f9cb281c87d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
1e17214b54e95f63c7c34488372692e6

SHA1
8ac6b442823d1753c89b734e874671b9abb3eebb

SHA256
f6beb6616e783e8a62754246a2e43aa465503a19238a2339a974396b208d0a7c

SHA512
e7da1276bbbfbcbfe63018d8ef56a74718c2a1d388d5c95c9b998d1e23a9e2d853cfe45683948f6e6e660b6056ca73213cfac5448514d62827c4821cd6f178fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
57259c49b0cd24f741e65d89491fd216

SHA1
0a41117b74939108811d91c616bf7e71a9eeb74a

SHA256
38216d2cd613013f55c2506818be7780704527470f5c5b72bf3ab9735599c769

SHA512
63d4e98e7507ce4fe1fda966da72c8e03e24175d8abba31338d5bb2512da0601fcb82106806e8c5fe044b238699eb694e04366de1026d9796a42ca1d11bb433f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1020B

MD5
a982d1bd4610693076ff8251466933fa

SHA1
74404e9153a4795bd63fcc3d40bafe39dbb238bc

SHA256
fd76058625a016b0d1a4eabbcbe2264d9b2c1441be2d6df00a172e1f79b24b67

SHA512
5c8df6f7ec6cdc99315a2d70d09e614277bd05c6480dd3b4a29c81dc4c65811c902e72b2597f146720653c9d473f3abb854e2c68aaaf846697c30fd23de137da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
16c15004268eb3e4e7dd85f92e906f43

SHA1
90c8fea5dd4344a2c1a91b5f887c8919728bd314

SHA256
d2c913e065fbed8b9e63d6e995d98ee66894937dd9bee62e50bd99ce20ff52cf

SHA512
1d7520ee2725230b49b91ab3534a3561388cc35673aed6f8125540528c105b5c8cc17d60baccb7ea4a717d652fd34ead994786be932b54b07423d6b8b2845c12

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
367B

MD5
f5844272d6c6ff0a47bfa4341539331b

SHA1
11fae0609ed908adc9ff074f0f5fea79d915f554

SHA256
476858d068993cb7dbdccc598b412db422b8b87e0a892e666276f638684b451b

SHA512
550f39916c1fda00e55226aa8e5d366b578399fef34227f180a5ca73e586799c7bdf005fa3d4f4ce2cc071eec2f67b3a1aaad3d87e181d6b48fce0088ab8aaf6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1020B

MD5
f91bbcc8b1629bc6e4543a2d25e330bf

SHA1
a2ef73a98ca173796d137e0521ccc5ce7e467b46

SHA256
1e24f991a39c53ca8156e01c82a7caf1d7df6e6c6d8324a6d1629ca4f233d5ab

SHA512
efb1cf3047d8a929555b273659912326557161f7ef6c2f0b30f8bc906a6b529aef31707da01cdb853b0e4adb9d951b64cb4a86997b2ffd7ce3d46ef95d3acb18

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
10cacfc3703988d5e120cd233ba38df3

SHA1
fb90c3130c362c98199b3582e52a95d89071d7d2

SHA256
ac69ba9c08482f17830e37d3efe288469bdbdd994686ed68005f7392b0061e00

SHA512
bad0d66fb13bf9d7541f5ca65a84e6b60e9c55876263648f050f618fcf4c00c22076f7c4a97eb0235bc2b060bd9fac6e44202cf621e10c9cd58d2e1cc233f0d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
cbc949fab88b1d63caf64ef93a7bd225

SHA1
85ecea04475b2046962a585e04eb7b90ce5cd8c7

SHA256
4aa3a57ea337fb0555db7cb7434cc6bb305f364820ef3ff54a398b54600e5bd5

SHA512
9f210c818a91dceb79099f83f9aa66d9ce6bb9b7f862d098226383cfbc55f24f2590dbcd8c75650858c3f08fbd04e2172df8acefb24e0a76e2de1246c537e91f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
dd0d70eaa081cf365918be333e805471

SHA1
30e6cce693365c24f5a46ee1d8d9441c3c72e9f7

SHA256
1b491a8c033748902e8245958d7746741c03409323d505962154f2b1278f3f2c

SHA512
3aa5b84b0cfc9c3cb1c825e4bb3ada6993c6ebae11570023461a30510080008659f7557a8f0a68efc1aa31ab8f3c80b793cec9f35736d2b8ede929b6314b42af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1b3b08633ef7459f42cfd004ac3c8402

SHA1
48d00cd7d40a24061dc82069f5f2c894108f3419

SHA256
dc7394f5feefde6ec985ce46fc4ba98cd318c4c527f4652320fd144667de2a66

SHA512
e64e8597d1669a4f1cbd72aa3030c3f267c4d3af838e4601ea7432733c671e42121687f8a280434bc823a630af7500f712f06f8ce6a6b6363ed708a5b4d348b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
6b6ace1511648d05b2fa1ff068b545b5

SHA1
7b3b53df709d806cbedcce4b425aff22afdfe32e

SHA256
f5f6350ee9617163cf83c68cca472f2e315dc3278e36d3b5afe142bca8926275

SHA512
b836f4bb9ebd5b01f156c30b468a6a0b87db96f10dc4c87f6d93f1dd569c764694f05d7e34a8f8ca39221c1f342fe88a12060b6432cba8b206fe273b3f2a44da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
921f235f44378c0ca824dc82b69050e0

SHA1
1fe3996f3ee0903d38dfa69fe059e205d5fe29ab

SHA256
5f583bd5860460003b3b1b74ec0e5a789c9bdaa8a5aec09ff6058542ff1c065e

SHA512
bc00438aae0c47ad6431717d7c9cf6d605467046ffa689626ff74e19bb6bbc8328c2fcaf7852232919c157b8cb906518b91310614db1fbd13b6f6103dc87c6ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
12KB

MD5
c19151d8b0b6ca35548716c945d6945c

SHA1
a2f5360a62e45a4784a186143db22cf2280b5573

SHA256
3badcc95ce6200566a8a9e5724ad0c086ed0198d3ff02721892ae2e41d23eb69

SHA512
1aedc6720aec24242706f9ac0e5c73220a9bf1b0324a121b715751b2be7b2bfa580d132395c1caaeabe6da875b165a7fb7b4238e843ca493b5d864f78d27910d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
272KB

MD5
87596e7c389ec372fd6db63e78485958

SHA1
4e2645dddd236389d8e0786c96cd9225a96f543e

SHA256
abdaadb717f3b255bf7e6ad92b9ccccde6f7ded370ca36e2d38e8b45522c71f9

SHA512
bd418b4a985464adcdebded73071aea710ea676d757ebae95c3355272184b66e1b5d6fba7002493002eeff71ad3598ed16dd59581bd7b0d163952cc4927f8f4b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
272KB

MD5
3f05eca364f1e7142c351cb33c377978

SHA1
88a73498f951bb7d55a52d206129a3a7c407ce6a

SHA256
853f15edf98cb31ab31776d4639fb9d6c8958df93401d99e49a6e58702d934cd

SHA512
72e5ab4ce24443f3fb366ce389919167b99764eb1cb3d0453afe9d8e73693f33fe857c0b3a268b33ff0b93602610714ab1e207da994ad4e99c1f6f9a31deb189

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
99KB

MD5
623e4fc24aee5e13f45952247c1961e0

SHA1
41387d92228a9df582765837a160c32836d004b5

SHA256
da7ee83cc5f32c6a6c49512165fd507ed142a08a350427110871861982fbbf40

SHA512
8015a244b03205429574d43363dde8c4cd481b9812f358fe539029716eae76dff79473ba8e306a802721924860c745616d3f3e7ba12187d37acf762155c110e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
113KB

MD5
f07300d126c9b6b973f85cfddcd85c06

SHA1
9f058b3ecf6da97dfffc3a1f9ecee96b80cfe5a8

SHA256
27e4b8c1c7b7a6a69d5515d977c5607074eecd3f30f6a671ec63a4bbcf6121ec

SHA512
aef6304fbe4e57ba6ffd000a59ea23bd487db55eb1a2a8298eb35d38c5a354ce7f5c7a23ccf31548da3145e1c695ebcbaa0e5cff2f6d7b357d01f247d1ca0e01

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe585dab.TMP

Filesize
92KB

MD5
67ce82dadf0b3e9fdeb87195f767b031

SHA1
8ac99701c874af3bb84e29a5b9f778f44381e238

SHA256
5ddd4126489874cad7c521f9dccbe77305dbff2d7989c565faa130943c992464

SHA512
b67bbc3fa5b43f93a369814b11cfd8af81dd6cf48ab3a456aeff4196d1b5354959888656d04fff102c04017ea97420cdfaf21f081a0d03e9d87d78f6fb161cd1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ORZAXET9\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\C7ND021V\favicon[1].ico

Filesize
23KB

MD5
ec2c34cadd4b5f4594415127380a85e6

SHA1
e7e129270da0153510ef04a148d08702b980b679

SHA256
128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7

SHA512
c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\PBYWKLPY\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF8E90E3EB5C845E48.TMP

Filesize
24KB

MD5
b1a056de706c547804d20a2a7977db1e

SHA1
396e1a710a5d18eb24f499e22eadfec13c48b43b

SHA256
748c484e2440234e6a0b84aaedeec5db72e9eac4b87496a207a6dc1e6a8cdf46

SHA512
e268893ea2aafe6a07e4556ddeb7bc26ac9cac78cef3c6653e132f3ec2226b9d173edd15c1c7bc0fafa881697655b5484bb74e38019f0a42f5df71b4a0f8c888

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OCommonResources.dll

Filesize
5.7MB

MD5
38cc1b5c2a4c510b8d4930a3821d7e0b

SHA1
f06d1d695012ace0aef7a45e340b70981ca023ba

SHA256
c2ba8645c5c9507d422961ceaeaf422adf6d378c2a7c02199ed760fb37a727f2

SHA512
99170f8094f61109d08a6e7cf25e7fba49160b0009277d10e9f0b9dac6f022e7a52e3d822e9aee3f736c2d285c4c3f62a2e6eb3e70f827ac6e8b867eea77f298

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OResources.dll

Filesize
19KB

MD5
554c3e1d68c8b5d04ca7a2264ca44e71

SHA1
ef749e325f52179e6875e9b2dd397bee2ca41bb4

SHA256
1eb0795b1928f6b0459199dace5affdc0842b6fba87be53ca108661275df2f3e

SHA512
58ce13c47e0daf99d66af1ea35984344c0bb11ba70fe92bc4ffa4cd6799d6f13bcad652b6883c0e32c6e155e9c1b020319c90da87cb0830f963639d53a51f9c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\MyDownloader.Extension.dll

Filesize
168KB

MD5
28f1996059e79df241388bd9f89cf0b1

SHA1
6ad6f7cde374686a42d9c0fcebadaf00adf21c76

SHA256
c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce

SHA512
9654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Newtonsoft.Json.dll

Filesize
541KB

MD5
9de86cdf74a30602d6baa7affc8c4a0f

SHA1
9c79b6fbf85b8b87dd781b20fc38ba2ac0664143

SHA256
56032ade45ccf8f4c259a2e57487124cf448a90bca2eeb430da2722d9e109583

SHA512
dca0f6078df789bb8c61ffb095d78f564bfc3223c6795ec88aeb5f132c014c5e3cb1bd8268f1e5dc96d7302c7f3de97e73807f3583cb4a320d7adbe93f432641

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\OfferPage.html

Filesize
1KB

MD5
9ba0a91b564e22c876e58a8a5921b528

SHA1
8eb23cab5effc0d0df63120a4dbad3cffcac6f1e

SHA256
2ad742b544e72c245f4e9c2e69f989486222477c7eb06e85d28492bd93040941

SHA512
38b5fb0f12887a619facce82779cb66e2592e5922d883b9dc4d5f9d2cb12e0f84324422cd881c948f430575febd510e948a22cd291595e3a0ba0307fce73bec9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\tis\Config.tis

Filesize
291B

MD5
bf5328e51e8ab1211c509b5a65ab9972

SHA1
480dfb920e926d81bce67113576781815fbd1ea4

SHA256
98f22fb45530506548ae320c32ee4939d27017481d2ad0d784aa5516f939545b

SHA512
92bd7895c5ff8c40eecfdc2325ee5d1fb7ed86ce0ef04e8e4a65714fcf5603ea0c87b71afadb473433abb24f040ccabd960fa847b885322ad9771e304b661928

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\app.ico

Filesize
766B

MD5
4003efa6e7d44e2cbd3d7486e2e0451a

SHA1
a2a9ab4a88cd4732647faa37bbdf726fd885ea1e

SHA256
effd42c5e471ea3792f12538bf7c982a5cda4d25bfbffaf51eed7e09035f4508

SHA512
86e71ca8ca3e62949b44cfbc7ffa61d97b6d709fc38216f937a026fb668fbb1f515bac2f25629181a82e3521dafa576cac959d2b527d9cc9eb395e50d64c1198

Download Submit
C:\Users\Admin\AppData\Local\setup82497757.exe

Filesize
3.8MB

MD5
29d3a70cec060614e1691e64162a6c1e

SHA1
ce4daf2b1d39a1a881635b393450e435bfb7f7d1

SHA256
cc70b093a19610e9752794d757aec9ef07ca862ea9267ec6f9cc92b2aa882c72

SHA512
69d07437714259536373872e8b086fc4548f586e389f67e50f56d343e980546f92b8a13f28c853fc1daf187261087a9dceb33769ba2031c42382742d86c60e4b

Download Submit
C:\Users\Admin\Downloads\Delta V3.61 b_82497757.exe

Filesize
9.5MB

MD5
1198daaa23f0af650c7cd4555fbef9e8

SHA1
783f86460785027a41a84e41b42a05b4d4a1a462

SHA256
25c846183e10bd2a146325effecddbabf0f390717fd11d597012a033e6daf600

SHA512
1a67d52794c2047936fc4814b70dd6474837b90df7a8b5653eb8a09cf98d4df2c93fb07451a29254e2e161e9e3f0c3f87e9f5e1252a2c89f2b7f95537e80227d

Download Submit
\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.LastScreen.dll

Filesize
57KB

MD5
6e001f8d0ee4f09a6673a9e8168836b6

SHA1
334ad3cf0e4e3c03415a4907b2d6cf7ba4cbcd38

SHA256
6a30f9c604c4012d1d2e1ba075213c378afb1bfcb94276de7995ed7bbf492859

SHA512
0eff2e6d3ad75abf801c2ab48b62bc93ebc5a128d2e03e507e6e5665ff9a2ab58a9d82ca71195073b971f8c473f339baffdd23694084eaaff321331b5faaecf6

Download Submit
\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.dll

Filesize
117KB

MD5
08112f27dcd8f1d779231a7a3e944cb1

SHA1
39a98a95feb1b6295ad762e22aa47854f57c226f

SHA256
11c6a8470a3f2b2be9b8cafe5f9a0afce7303bfd02ab783a0f0ee09a184649fa

SHA512
afd0c7df58b63c7cfdbedea7169a1617f2ac4bad07347f8ed7757a25ab0719489d93272109b73a1b53e9c5997dedad8da89da7b339d30fc2573ca2f76c630ddb

Download Submit
\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2ODAL.dll

Filesize
15KB

MD5
422be1a0c08185b107050fcf32f8fa40

SHA1
c8746a8dad7b4bf18380207b0c7c848362567a92

SHA256
723aea78755292d2f4f87ad100a99b37bef951b6b40b62e2e2bbd4df3346d528

SHA512
dff51c890cb395665839070d37170d321dc0800981a42f173c6ea570684460146b4936af9d8567a6089bef3a7802ac4931c14031827689ef345ea384ceb47599

Download Submit
\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OModels.dll

Filesize
75KB

MD5
c06ac6dcfa7780cd781fc9af269e33c0

SHA1
f6b69337b369df50427f6d5968eb75b6283c199d

SHA256
b23b8310265c14d7e530b80defc6d39cdc638c07d07cd2668e387863c463741d

SHA512
ad167ad62913243e97efaeaa7bad38714aba7fc11f48001974d4f9c68615e9bdfb83bf623388008e77d61cee0eaba55ce47ebbb1f378d89067e74a05a11d9fe3

Download Submit
\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OServices.dll

Filesize
160KB

MD5
6df226bda27d26ce4523b80dbf57a9ea

SHA1
615f9aba84856026460dc54b581711dad63da469

SHA256
17d737175d50eee97ac1c77db415fe25cc3c7a3871b65b93cc3fad63808a9abc

SHA512
988961d7a95c9883a9a1732d0b5d4443c790c38e342a9e996b072b41d2e8686389f36a249f2232cb58d72f8396c849e9cc52285f35071942bec5c3754b213dd5

Download Submit
\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OUtilities.dll

Filesize
119KB

MD5
9d2c520bfa294a6aa0c5cbc6d87caeec

SHA1
20b390db533153e4bf84f3d17225384b924b391f

SHA256
669c812cb8f09799083014a199b0deee10237c95fb49ee107376b952fee5bd89

SHA512
7e2e569549edb6ddd2b0cb0012386aed1f069e35d1f3045bb57704ef17b97129deb7cde8e23bc49980e908e1a5a90b739f68f36a1d231b1302a5d29b722e7c15

Download Submit
\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OViewModels.dll

Filesize
8KB

MD5
be4c2b0862d2fc399c393fca163094df

SHA1
7c03c84b2871c27fa0f1914825e504a090c2a550

SHA256
c202e4f92b792d34cb6859361aebdbfc8c61cf9e735edfd95e825839920fb88a

SHA512
d9c531687a5051bbfe5050c5088623b3fd5f20b1e53dd4d3ed281c8769c15f45da36620231f6d0d76f8e2aa7de00c2324a4bf35a815cefc70ca97bc4ab253799

Download Submit
\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\HtmlAgilityPack.dll

Filesize
154KB

MD5
17220f65bd242b6a491423d5bb7940c1

SHA1
a33fabf2b788e80f0f7f84524fe3ed9b797be7ad

SHA256
23056f14edb6e0afc70224d65de272a710b5d26e6c3b9fe2dfd022073050c59f

SHA512
bfbe284a2ee7361ada9a9cb192580fd64476e70bc78d14e80ad1266f7722a244d890600cf24bfb83d4914e2434272679ba177ee5f98c709950e43192f05e215e

Download Submit
\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\MyDownloader.Core.dll

Filesize
56KB

MD5
f931e960cc4ed0d2f392376525ff44db

SHA1
1895aaa8f5b8314d8a4c5938d1405775d3837109

SHA256
1c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870

SHA512
7fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0

Download Submit
\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Ninject.dll

Filesize
133KB

MD5
8db691813a26e7d0f1db5e2f4d0d05e3

SHA1
7c7a33553dd0b50b78bf0ca6974c77088da253eb

SHA256
3043a65f11ac204e65bca142ff4166d85f1b22078b126b806f1fecb2a315c701

SHA512
d02458180ec6e6eda89b5b0e387510ab2fad80f9ce57b8da548aaf85c34a59c39afaeacd1947bd5eb81bee1f6d612ca57d0b2b756d64098dfc96ca0bf2d9f62f

Download Submit
\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferSDK.dll

Filesize
172KB

MD5
b199dcd6824a02522a4d29a69ab65058

SHA1
f9c7f8c5c6543b80fa6f1940402430b37fa8dce4

SHA256
9310a58f26be8bd453cde5ca6aa05042942832711fbdeb5430a2840232bfa5e4

SHA512
1d3e85e13ff24640c76848981ca84bafb32f819a082e390cb06fe13445814f50f8e3fc3a8a8e962aae8867e199c1517d570c07f28d5f7e5f007b2bb6e664ddb1

Download Submit
\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\SciterWrapper.dll

Filesize
134KB

MD5
105a9e404f7ac841c46380063cc27f50

SHA1
ec27d9e1c3b546848324096283797a8644516ee3

SHA256
69fe749457218ec9a765f9aac74caf6d4f73084cf5175d3fd1e4f345af8b3b8b

SHA512
6990cbfc90c63962abde4fdaae321386f768be9fcf4d08bccd760d55aba85199f7a3e18bd7abe23c3a8d20ea9807cecaffb4e83237633663a8bb63dd9292d940

Download Submit
\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.Net.dll

Filesize
101KB

MD5
83d37fb4f754c7f4e41605ec3c8608ea

SHA1
70401de8ce89f809c6e601834d48768c0d65159f

SHA256
56db33c0962b3c34cba5279d2441bc4c12f28b569eadc1b3885dd0951b2c4020

SHA512
f5f3479f485b1829bbfb7eb8087353aee569184f9c506af15c4e28bfe4f73bf2cc220d817f6dfc34b2a7a6f69453f0b71e64b79c4d500ff9a243799f68e88b9f

Download Submit
\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.dll

Filesize
151KB

MD5
72990c7e32ee6c811ea3d2ea64523234

SHA1
a7fcbf83ec6eefb2235d40f51d0d6172d364b822

SHA256
e77e0b4f2762f76a3eaaadf5a3138a35ec06ece80edc4b3396de7a601f8da1b3

SHA512
2908b8c387d46b6329f027bc1e21a230e5b5c32460f8667db32746bc5f12f86927faa10866961cb2c45f6d594941f6828f9078ae7209a27053f6d11586fd2682

Download Submit
\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\msvcp140.dll

Filesize
426KB

MD5
8ff1898897f3f4391803c7253366a87b

SHA1
9bdbeed8f75a892b6b630ef9e634667f4c620fa0

SHA256
51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad

SHA512
cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03

Download Submit
\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\vcruntime140.dll

Filesize
74KB

MD5
1a84957b6e681fca057160cd04e26b27

SHA1
8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe

SHA256
9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5

SHA512
5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa

Download Submit
memory/2316-16-0x0000023601320000-0x0000023601330000-memory.dmp

Filesize
64KB

Download
memory/2316-535-0x00000236003F0000-0x00000236003F1000-memory.dmp

Filesize
4KB

Download
memory/2316-0-0x0000023601220000-0x0000023601230000-memory.dmp

Filesize
64KB

Download
memory/2316-531-0x0000023605510000-0x0000023605511000-memory.dmp

Filesize
4KB

Download
memory/2316-35-0x00000236054E0000-0x00000236054E2000-memory.dmp

Filesize
8KB

Download
memory/2316-528-0x0000023605690000-0x0000023605692000-memory.dmp

Filesize
8KB

Download
memory/2568-96-0x0000020BF8810000-0x0000020BF8812000-memory.dmp

Filesize
8KB

Download
memory/2568-92-0x0000020BF7D30000-0x0000020BF7D32000-memory.dmp

Filesize
8KB

Download
memory/2568-62-0x0000020BF7570000-0x0000020BF7572000-memory.dmp

Filesize
8KB

Download
memory/2568-66-0x0000020BF75B0000-0x0000020BF75B2000-memory.dmp

Filesize
8KB

Download
memory/2568-64-0x0000020BF7590000-0x0000020BF7592000-memory.dmp

Filesize
8KB

Download
memory/2568-82-0x0000020BF75D0000-0x0000020BF75F0000-memory.dmp

Filesize
128KB

Download
memory/2568-94-0x0000020BF7FE0000-0x0000020BF7FE2000-memory.dmp

Filesize
8KB

Download
memory/2616-270-0x0000020599C00000-0x0000020599D00000-memory.dmp

Filesize
1024KB

Download
memory/2616-288-0x00000205AA880000-0x00000205AA980000-memory.dmp

Filesize
1024KB

Download
memory/2616-287-0x00000205AA820000-0x00000205AA840000-memory.dmp

Filesize
128KB

Download
memory/2616-291-0x00000205AC620000-0x00000205AC640000-memory.dmp

Filesize
128KB

Download
memory/2616-269-0x0000020599C00000-0x0000020599D00000-memory.dmp

Filesize
1024KB

Download
memory/2616-309-0x00000205ABC40000-0x00000205ABD40000-memory.dmp

Filesize
1024KB

Download
memory/4500-42-0x00000141906C0000-0x00000141907C0000-memory.dmp

Filesize
1024KB

Download
memory/5976-1372-0x0000000006640000-0x0000000006678000-memory.dmp

Filesize
224KB

Download
memory/5976-1373-0x0000000006830000-0x00000000068E0000-memory.dmp

Filesize
704KB

Download
memory/5976-1378-0x00000000071C0000-0x0000000007510000-memory.dmp

Filesize
3.3MB

Download
memory/5976-1374-0x0000000006C60000-0x0000000006CD6000-memory.dmp

Filesize
472KB

Download
memory/5976-1377-0x0000000006D10000-0x0000000006D2E000-memory.dmp

Filesize
120KB

Download
memory/5976-1371-0x00000000065F0000-0x00000000065F8000-memory.dmp

Filesize
32KB

Download
memory/5976-1370-0x0000000000AB0000-0x0000000001BB6000-memory.dmp

Filesize
17.0MB

Download
memory/5976-1379-0x0000000007630000-0x00000000076CC000-memory.dmp

Filesize
624KB

Download
memory/5976-1380-0x000000000C410000-0x000000000C418000-memory.dmp

Filesize
32KB

Download
memory/5988-1044-0x0000000005530000-0x0000000005558000-memory.dmp

Filesize
160KB

Download
memory/5988-1118-0x0000000005D20000-0x0000000005D32000-memory.dmp

Filesize
72KB

Download
memory/5988-975-0x0000000000740000-0x0000000000B18000-memory.dmp

Filesize
3.8MB

Download
memory/5988-1167-0x0000000006F30000-0x0000000006FC2000-memory.dmp

Filesize
584KB

Download
memory/5988-1156-0x0000000007CC0000-0x0000000008274000-memory.dmp

Filesize
5.7MB

Download
memory/5988-1152-0x0000000007200000-0x00000000076FE000-memory.dmp

Filesize
5.0MB

Download
memory/5988-1146-0x0000000006CE0000-0x0000000006CEC000-memory.dmp

Filesize
48KB

Download
memory/5988-1142-0x0000000006610000-0x0000000006960000-memory.dmp

Filesize
3.3MB

Download
memory/5988-1141-0x00000000065E0000-0x0000000006602000-memory.dmp

Filesize
136KB

Download
memory/5988-1140-0x00000000064D0000-0x00000000064DA000-memory.dmp

Filesize
40KB

Download
memory/5988-1135-0x0000000006550000-0x00000000065DC000-memory.dmp

Filesize
560KB

Download
memory/5988-1190-0x0000000009380000-0x00000000093AE000-memory.dmp

Filesize
184KB

Download
memory/5988-1102-0x0000000005640000-0x000000000565D000-memory.dmp

Filesize
116KB

Download
memory/5988-1092-0x00000000056B0000-0x00000000056DC000-memory.dmp

Filesize
176KB

Download
memory/5988-1084-0x0000000005660000-0x0000000005668000-memory.dmp

Filesize
32KB

Download
memory/5988-1076-0x0000000005590000-0x000000000559A000-memory.dmp

Filesize
40KB

Download
memory/5988-1068-0x0000000005610000-0x0000000005634000-memory.dmp

Filesize
144KB

Download
memory/5988-1060-0x0000000005560000-0x000000000557A000-memory.dmp

Filesize
104KB

Download
memory/5988-1052-0x00000000055A0000-0x00000000055D2000-memory.dmp

Filesize
200KB

Download
memory/5988-1036-0x00000000054D0000-0x00000000054FE000-memory.dmp

Filesize
184KB

Download
memory/5988-1010-0x00000000054A0000-0x00000000054C8000-memory.dmp

Filesize
160KB

Download
memory/5988-1002-0x0000000005470000-0x0000000005494000-memory.dmp

Filesize
144KB

Download
memory/5988-994-0x0000000002DD0000-0x0000000002DE4000-memory.dmp

Filesize
80KB

Download
memory/6000-1244-0x00000000005F0000-0x00000000005FC000-memory.dmp

Filesize
48KB

Download