hxxps://go[.]enderman[.]ch/noescape

Analysis

max time kernel
210s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 17:22

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://go.enderman.ch/noescape

Score

10^/10

evasion persistence ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

NoEscape.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\winnt32.exe"	NoEscape.exe

UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

NoEscape.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NoEscape.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NoEscape.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

NoEscape.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	NoEscape.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

NoEscape.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	NoEscape.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	NoEscape.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

28 raw.githubusercontent.com
29 raw.githubusercontent.com

flow	ioc
28	raw.githubusercontent.com
29	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

NoEscape.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\noescape.png"	NoEscape.exe

Drops file in Windows directory 2 IoCs

Processes:

NoEscape.exe

description ioc process

File created C:\Windows\winnt32.exe NoEscape.exe
File opened for modification C:\Windows\winnt32.exe NoEscape.exe

description	ioc	process
File created	C:\Windows\winnt32.exe	NoEscape.exe
File opened for modification	C:\Windows\winnt32.exe	NoEscape.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "237"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe

Modifies registry class 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2539840389-1261165778-1087677076-1000\{AD9A6AB0-228D-45EA-9E38-7F760DF5E14C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exe

pid	process
2288	msedge.exe
2288	msedge.exe
5116	msedge.exe
5116	msedge.exe
2308	identity_helper.exe
2308	identity_helper.exe
976	msedge.exe
976	msedge.exe
772	msedge.exe
772	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

Processes:

msedge.exe

pid	process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 1628 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 1628 AUDIODG.EXE

description	pid	process
Token: 33	1628	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1628	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exeNoEscape.exe

pid	process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
2132	NoEscape.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

3388 LogonUI.exe

pid	process
3388	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 5116 wrote to memory of 1384	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1384	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3364	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 2288	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 2288	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1952	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1952	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1952	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1952	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1952	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1952	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1952	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1952	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1952	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1952	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1952	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1952	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1952	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1952	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1952	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1952	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1952	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1952	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1952	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1952	5116	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.enderman.ch/noescape
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb93be46f8,0x7ffb93be4708,0x7ffb93be4718
2⤵
PID:1384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
2⤵
PID:3364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
2⤵
PID:1952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
2⤵
PID:1860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
2⤵
PID:2744

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
2⤵
PID:452

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
2⤵
PID:2712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
2⤵
PID:5100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4596 /prefetch:8
2⤵
PID:1976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
2⤵
PID:876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
2⤵
PID:1864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
2⤵
PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
2⤵
PID:2040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
2⤵
PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5720 /prefetch:8
2⤵
PID:4160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4900 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1048 /prefetch:1
2⤵
PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
2⤵
PID:1420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1980 /prefetch:1
2⤵
PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
2⤵
PID:380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1960 /prefetch:1
2⤵
PID:2272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
2⤵
PID:232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:1
2⤵
PID:2532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
2⤵
PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6880 /prefetch:1
2⤵
PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
2⤵
PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
2⤵
PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7144 /prefetch:1
2⤵
PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:1
2⤵
PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
2⤵
PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7032 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
2⤵
PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10258624683466548181,3839652961061647335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7020 /prefetch:1
2⤵
PID:2552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3252

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3864

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2c8 0x150
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4540

C:\Users\Admin\Downloads\NoEscape\NoEscape.exe
"C:\Users\Admin\Downloads\NoEscape\NoEscape.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:2132

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa398f855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3388

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:4424

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Modify Registry

T1112

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Defacement

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Filesize
67KB

MD5
d2d55f8057f8b03c94a81f3839b348b9

SHA1
37c399584539734ff679e3c66309498c8b2dd4d9

SHA256
6e273f3491917d37f4dbb6c3f4d3f862cada25c20a36b245ea7c6bd860fb400c

SHA512
7bcdbb9e8d005a532ec12485a9c4b777ddec4aee66333757cdae3f84811099a574e719d45eb4487072d0162fa4654349dd73705a8d1913834535b1a3e2247dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Filesize
40KB

MD5
0ea3c40e1faf37122a20a202e9b52714

SHA1
ac0d594878e4160c112d7f70b5c680523dcee1a4

SHA256
ad3eac09f7aaaed3059ec039ea0477af10919a4a9be9a8865dce7fd34776c8b0

SHA512
e19363456375a8b1a0887af217befabf3dfa5c6944b9b4b62a04d20ce6e5649af4309b86ecfaf061ebcf243011eef123c3f75ebf2dba32d18ce28140adbca52d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Filesize
1.2MB

MD5
991cdad1cf921ac5ce995a0ec9b6e312

SHA1
a3fef88dbfd32034daab4811e8446791d2481c6c

SHA256
a2590c2b03e01f0ef1181caa7c78800ede4255186ae37c1a28194698f8f19324

SHA512
807937d9f9bbf1fad83784ee802d40195edf45dcff47d11ceebdc83bd3151f773f1e36a8e8ffcaceaea707dbdf948ec0f4577f325739ad9d4f63fc6596a341ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d
Filesize
41KB

MD5
26a659abef86727454d7be646e9f294e

SHA1
95fd8084e5fb10da9168999916f19a8468a8dbaa

SHA256
8eb40603a1ba25fc95804cdef371e04b466476691b988d7e9648d9fadb38011a

SHA512
dc47340f6107c1d743d77222f651ef59e08857eb674f9a99b1be83b43293913df04922176b7c601879e27c4f66c1c5d002c68951f9e6e3340d537efa01f51491

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040
Filesize
32KB

MD5
94fd864eff41d2466c55e3d0d47e92c7

SHA1
2c8ab5e8d1ac7f09af3c09de7575f8ad55706094

SHA256
b7b245e311013279605a274aacf18e2f9314ea6c275aa4c54f7676c63f9b9248

SHA512
4e1f2656222174c5442a5af47a63bc56acb71d8f34809aec6f33e15f6e15d6e8e81f72a8aff925c09bc2d4a0d9f55b408d7d8dcb7ec01519e431a3dd28e1f682

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000041
Filesize
18KB

MD5
ca5cfb80b6185013a1fe31a3440817f8

SHA1
eec5dbaba370417b8e3caa91b1445fbfed18e60c

SHA256
4a6342c556481a2b534b42756a4c74ebf2d336b4a27a1e5a52cf0ad1b99566ec

SHA512
859024738b2a7b95aa6d70bff42824e01bf0f484bb4cd8208f56916a5ea7ec97ebd4f92734a44092574aaa2a5a6ab63f5e43d26dd9f8f2fac5b38275392ad045

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000042
Filesize
23KB

MD5
e39b6cf311ba32121329e891bbd5d8ed

SHA1
b7c0f44c75c46ced9864b9a1543d4d8ba7f98219

SHA256
a1edcc8a3157c491ce4f40f425938446f5820bd652c79cfdfed43597d9f5fc3f

SHA512
2d555c51fcee9f10f17fc3029ba6367262572280b9983f90e07c9ce1603e6b9739ff0bc3ade14f33d7df91d66a6d72535208b4cb1be5d356d6449fe086367ce0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000048
Filesize
19KB

MD5
18c0ca3a1975692afe41dc9e596046bb

SHA1
9681f7b7882ebeae27b9771a6a3e008e082e5009

SHA256
dd672a9f075324f0751eef09dc4d1f4ab0e79acd189d7c860134b6bad13e2df9

SHA512
f71c2df42280e4f1120b69f64884385ac88385a660b64c6a8dfd81d9f7d4212c63746ac7fb3885f4e616800f819f3fe99cd4e22df96fc6fe6bfe3f0c61513ffe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
3KB

MD5
7ea0138639ab83fc82d9f1f238a1f03d

SHA1
074410b38a6a259d862a7ef1045c126aa53a36c8

SHA256
4ac4eb90c946f29e7cc04291a31759af8e0a7de1e6e27158e656d79b7fa40292

SHA512
d6c5a6aa3ca262588829d2fe652677983e9c09da61533348edecd99e8958e3b32f09cef3acd298e33cef385b647084e7fe99b76918b3869f5376b28aad0229af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
333B

MD5
7d785b1c31275a1e3a9985405eae5b98

SHA1
fd52b2bad48862b94156a595572d6028250b10a2

SHA256
59435fab3372e8607ebc16634d334c057835f3ec93780fa5a66088e2b5843e2e

SHA512
9df4af1c4a30c69e933daab612ce9258c2a3e61636078debaaa448fdcd190353718795b3ca0f9d5daa8387f56eaa25f4c538075d7144bbb1b65772e6f043d050

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
5KB

MD5
1f81cdbc06eba98cdf0e3a17ab74f2ef

SHA1
ea9ad42980f9c754a85f9317be88b379ca74fed1

SHA256
d344ccc15c9330c9c5a2429d59c168ad9755a34090a1085dc4ac18f18e48409d

SHA512
a433d14e860f6ca02c774d5c2396c713354760a09745cf28ed8d1e92cd44052e8e6818a83ab7f7febf6905eed42751fd08b67ef6c410e67ce3e06ade4f830644

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
1b7dc3206c41a993075600c16cd7a291

SHA1
983d5cd882b0ad819c9c6faa781e5daa0c7f5630

SHA256
87015f765a4ae6f2ffbd3d1aab4aaa06373ab3c1e999996e02632d47cb76afa8

SHA512
6fe7132b450d6e22780c60e4866b031550e1c89552d240eeeeb190a3eab71fc94c2589d1b6adcf23f052dfa9c5388eac6354a2c4c83c5d980a928565f8fa40a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
283904c12b0357dca6f800ddbdec3bc7

SHA1
e70bbab0a6c12586be5abafa26aa5d087cea11f8

SHA256
8bed2a04215189a50523a9ca7138f13aed552f4350c185a208cff68090040ffd

SHA512
028107987dc9d7f62feb220d866c0c8191278e7d8faee8690bdbe22fb05a0e4f5e302062ac173dc564f8fb78ef597c9f997e755208f9cc7b51812ec6f8d403e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
69f60aa7c543b08f42c6121a70e1257a

SHA1
88cd1a71e7417cda2632f0376e4c66117e8aaa43

SHA256
3ff8fe7dc54a85e2bbac705a47660373f822fe39de8ab092b465f84258d800a4

SHA512
e8bbb681802ab1fbfb8c56aa126fb241543c4d28f1902646411858536302fbde07e34926d5b8e3c7a23b6a7ac02aa57a4e1272aaaa582c71c7352c7fb2a1d48d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
eafddf7586da4748cca42516a826d294

SHA1
43122ee86b862495fcb5fb0313ad3d960a5cbedc

SHA256
6ab118141eda9982195f2276b8c96bec220663ffe3dbd1228eec301c608fbdf8

SHA512
40f55fffcf590770bd966b6a1834a922548a8f33931a04855f403b5dcdb2374a0d5ad56252176ad52538dd8c8a13bffeb934d5821406b9d484e32bff12b25266

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
a8f42380cbdaa734a0f7ad8a262fdf36

SHA1
c87dd532d4cf5334c8f0c4227c5338e221e345ec

SHA256
5907288217ee74095ad8c668dea58f95c2a91355be4b39039e594f2fb183a3cc

SHA512
145a5add89868c7ef4627c3be67a08f136a1acc14d2e5c61fa2cd954608cbfba02215a36cbe556fe236a9b608f25b509bf5950c5040c5eff0db8d5cb160f2aee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
a4982fb9dbadadc00246fcf2ddad5de5

SHA1
b59f8e30bf5826b318b2869adb2b40da0069a99a

SHA256
af7192722bc0aebc7d1e2f6784b419aff84d7a636f6c8309f8ec579a7a149063

SHA512
b9fee326189af255587a98bfc76db10524d65d70d80e9f6301f5271dec2a17b6e0bfb69a52deca8085da9a1fbfc8677390b672bd972a5d5b87f07628c7432e3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ad75a420-d4c7-4970-9f58-f26c04c7a8de\index-dir\the-real-index
Filesize
2KB

MD5
b7f0888f0df1044d805efaedc277315a

SHA1
e10327b7543bb9e654cf44e25a97f312300067db

SHA256
908c601e43ae04994fe592d7a99fd8ac724d9b7703d0bddb3df9ccc2f4303697

SHA512
49c3ae29f4b07acda12f091b6537f75644545e60eae55ef23ee995bf33fef2df2bd2aa299b94ca66cee8b8f71769495df5364c76e3342233cf1da04a09bb1745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ad75a420-d4c7-4970-9f58-f26c04c7a8de\index-dir\the-real-index
Filesize
2KB

MD5
2d6618ba4a0596d7204b6c61b5c880dc

SHA1
55f98f374b28019610ace4aba43179a4b1cdd4f6

SHA256
8d9b020c3b426f147d74c214baa155d6694b3cfd2f78820d7b8aae59436bddd4

SHA512
35d8d719a622338fc145fcf79ce7c3e298a32e6eb8e41c94e141e52fb3ad31e3c4bcf6cb18ece9e574ada2e1fab0c94416ba9b77c475a6828947017b32cfc0a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ad75a420-d4c7-4970-9f58-f26c04c7a8de\index-dir\the-real-index~RFe5926a9.TMP
Filesize
48B

MD5
6f22cf4d44a2f12e421db1c80bc351b3

SHA1
303e95f4184189c5f8274e4c634b0fb0e27bea80

SHA256
ecb69546ef43645a0fdb81ae5004f5e93cabe646acdf5a95120ca3656ea21d24

SHA512
652caaf4b2d93f8ad0ba7e4ba28faad788e50f047b5c978f39f0ba98775b1aa1b44674d10f8d5848bc5398fd0ab3058a399ab150eb8be3517209e20d75dd75e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\cf926b8d-6c36-4e20-8e69-c378c27a1468\index
Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
89B

MD5
6d58cf6af844fc208c31377537f4ad72

SHA1
f7fac3958aa00125c10306fbbbe3ff57874e21dc

SHA256
254d0656e78486548c1befafb849110ac8f208c0b9ec7ef1aaf872b809edf628

SHA512
a829eed9a561f02958f7969ae02ad85359e275061dc3c3c2f1074b6791e5d77a8a82e0398d6aa46fea44550a6ee108ee3cfa8571e2bc5c389ffd4e3e49980c05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
146B

MD5
f61d8a26c907dca7e0bba0f118346171

SHA1
aa001461b6eafb8392b3139cc7bef1e6048f002d

SHA256
b028c9464e446f961dcb738a524024f0f18a3258ac1c189b3770b06c7b120279

SHA512
970970d6c9a9e4a6e3be59b53848b45a64c0d2c55daeb0059d9688fedd4cf522510e8fe103dd555dedabb1dcff42d20037681da0a41e38f7392cd5ab1d673a03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
82B

MD5
49f5472f423c1676b56b86eada933cec

SHA1
ae16f182dc335b0d579bae412b9777bb8fa8a914

SHA256
92982b23680bd519b74ace101c8836e6b78812694b62eeba4a87fd709913e652

SHA512
3c365289da54b6c7e7209cf573de47d7a0f97563dcb1c3795ca63fcda75f86f3b012667a825bef4b676a5deb8237e91b3f4cfb51005220e094979d0ee9c22052

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
148B

MD5
1456b2bba334cbb533756217f4e8a02a

SHA1
b1f0f75c10c44a8ccbdc4465e1671540fc68f3a2

SHA256
675e5a304b290feafc94dbdda7e9c45e19e687fe9e3af4d9c4242b2a804a7fda

SHA512
d79365ae904187c216d67de39150c5b90d8a0d4ae5c1b56b39ec28c7fbf2481f644683a84e108215306f75be3e260c33ddfe6d5e5367688d087d617dddb20118

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
84B

MD5
8e69dcb0f355a2329fc48d7bf8f3f929

SHA1
d6c6cfd2be5c88899f40d27e946ddef1dc914530

SHA256
98f99cf01aa8179a2271d47bdbd84006ebf8fb7d5620747ebf01273b4b8ebee7

SHA512
ecbd02a0a759250125857ad653344cb7ccc2a51f8b14e97a01809037952c906afa97280a7336cb1e1d26482cc503a0f22ba4709f9433ecc11b32c2ed07c87442

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
84B

MD5
ba7bf43f34a64ad5031eb2f59afdaded

SHA1
6d3ac1398e1aa8d930a794aceb2f487c754a05c7

SHA256
4797dbcf56b6a1a86ed0809d871d5a0778c69b3053e8d40c3d9c37c19c800f88

SHA512
4c02aa9b221c17ee8359218b650061ebbbe12c8e2fe3fdbdfef251585eda28e1379dda2562662924a0c5ebcc0ddb63457e672ce55b7ee9697db183bbb4d0b60f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
72B

MD5
6b8668c6eddf2be2430967757fe5b3aa

SHA1
40075ac26efe9d863f63c99ad1414122350c9747

SHA256
2864126c8c60f69197e36325a73f32061aecca21d4c576d68be1da5da82be098

SHA512
553b2498df17622e695bf20ffec55fb743c0632c78964a07b39380d9ec3c431763d682978aad6276f4d100db5583990ffa79207450b5629ae29339351c33c1c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595308.TMP
Filesize
48B

MD5
4cfeb22bed91e343f4f30d360691e7a5

SHA1
cfc5d97ed4c966028475d21b7a23ae168299804d

SHA256
785fe9ebb62d0c8fe61b8186f7a97cdaed2b568ed5d3d1c72c21bcaa991f8541

SHA512
976a47d37f665ef07271810dd6b9affab21c10e4ba71e55d67ac27fc55e0d3d07ad8ccbcd46ba9ea252286b308adae4eaf37a141a052a77215ded4505bdbab1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
873B

MD5
cd5bb62d6c86ef4072399a660dd52f95

SHA1
d49f045e26e11962bd65de25e4ac924710e5e9fd

SHA256
e9fed9313a88eac4d382192a425c3cb2515047c31fe391e42748f0779f96b8bc

SHA512
5ce4f51dd98e4b8208809b441dc19a173f4ae1ab08137f1f2492af8125357a5a4241bfaa3ada025041fc988b4cfebaffe76c0e8468b44938c90f16561b411673

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
45acfd415ed9610dcd840bc391879a38

SHA1
769441218c5ee0608730db543ebdb8249dd8ed0f

SHA256
5178a6a8922359d6e66c0ae5505a1ac683d8b7c498a809da79309b0ca39d7b2c

SHA512
2664a9bdbad2534b4662eb5373de6ff30235107f93acb64b90d055bc9853f2b05223e97f932e69d578f244ec583b3a51cda2574a904f414e901f1f10a4f29fe9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
01336b6e90bed76839504a272cb95142

SHA1
8438bc6d337ed264b0da8474f1f3049fe5a31d65

SHA256
562218f111fed0e424de405c7ce199f6f0084d429944372031d6547045286f87

SHA512
c295ca05331c3713c85bed356205289430144ee2bb85468ab82353409bafdb0f6019ad013c0a5cb5e49fa1f957eb4c396130e475f680756c6e2b35773a6ad233

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
86e454a2112fdf82b9be2df4b6ecd455

SHA1
96f3c6af980ebaab746a597a78ce786ec8587e6a

SHA256
cc4c8f61812776d870f696dd2433ab933f099496ddd4c0ffa3bb141d8a8b546b

SHA512
103cfb0411fd8a2c2eb22dbd126f97ff7e28bc55957b943c5f566acd4a6ee4e6bfb81af1f036e42268b58c7538c1e39671713f2d7c4726918ee62f4281bce9ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58bfa2.TMP
Filesize
371B

MD5
eb717056daf22075a7fa3b4ac1fa8583

SHA1
ac5923cc0b6188ec0b683781d180e9436f834a1c

SHA256
4ef6333fc735f8958aa959fc76f0c366a5b5abbbed466bf5bc4b2fe4b010c3ff

SHA512
6689860bde9a1a325a2f90c24c0e33f66a0aab5eace9aafb39f525eedb85118d1a3842bc4a5961ba08823f05e259f88229cf0ff9cda850de8d96345eee23ab0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\acbd4b73-df92-4c2c-bb08-0ef35af91498.tmp
Filesize
8KB

MD5
41a712cb46accaaa82a5274263e9ebb7

SHA1
973d13786c080838040e99798de2dd5dfbcf6d0e

SHA256
f4132a7a19f9ad14321aa929e85cb90f9ed181dfc08457c6c2bc891ee30ac237

SHA512
da9548eef3e3a067ecb11a40ec4c3e67545b7111bd0fdf97dab0bc4b2153ce983c81beeab4b7fa866935293a4371fe3e5bb219833662f738f376f456ff9fcaf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
93522a37d4b629860e581948aa002ddc

SHA1
27d9777383f0da2790fa071554f4e5090773a379

SHA256
a9c917e478e1d45bdc8520a861a24239648d00015ca343f41116b289f947e10a

SHA512
b9966ce758e42beb336bfc284e7307f8aebe8cc60bdda2c4bb7964c932a70c7f026d45c19e1034414ac0b59458229e7739bcdff39e70930083554bdc83b39f96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
36e3622adb51c97c72e5b33cfac8c101

SHA1
7392f167da59cc28c33a124a0aa87170ff60e254

SHA256
5f9407caad828d30d749fd5556ab46e7c05997a4e68e18b2a03db2e2f8ac7a5f

SHA512
2a2e7cec39aa0a4726b1d619aa3345a1951a2743c66f26cab4dc4d96b53cae92feffd191de89995b2ce010fe5a48ad47dbb2a08b66d07ec03a09f2d0ea663b4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
b6f5a5dc04cdaccc59d9f042b165965f

SHA1
844cd8425dadab02cf6327967e30d2ce053e5598

SHA256
6806bdb0e4ef1c412d9dbd6bbfefa3d7daf74bae9b2b542eef242ba3257298cd

SHA512
587ebb68e0bb6f07f57f62f148992c82fa2dd96727fdc7b55b396a0bae8b0415fcba8a737156bfb453893de930b7e2f552f58f94f469352db59188ffbb631769

Download Submit
C:\Users\Admin\Downloads\NoEscape.zip
Filesize
616KB

MD5
ef4fdf65fc90bfda8d1d2ae6d20aff60

SHA1
9431227836440c78f12bfb2cb3247d59f4d4640b

SHA256
47f6d3a11ffd015413ffb96432ec1f980fba5dd084990dd61a00342c5f6da7f8

SHA512
6f560fa6dc34bfe508f03dabbc395d46a7b5ba9d398e03d27dbacce7451a3494fbf48ccb1234d40746ac7fe960a265776cb6474cf513adb8ccef36206a20cbe9

Download Submit
C:\Users\Public\Desktop\৯ᖛ⃎Ᏹ᳟ᑜ⇤⢼ᓤ᜵ᙒ࢈ᐏᖻ॰Ⱌ⣔ᯪ␊↯∅༡࢔ᐺ⑅ៜ⢇ⱚ⟠
Filesize
666B

MD5
e49f0a8effa6380b4518a8064f6d240b

SHA1
ba62ffe370e186b7f980922067ac68613521bd51

SHA256
8dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13

SHA512
de6281a43a97702dd749a1b24f4c65bed49a2e2963cabeeb2a309031ab601f5ec488f48059c03ec3001363d085e8d2f0f046501edf19fafe7508d27e596117d4

Download Submit
\??\pipe\LOCAL\crashpad_5116_SBGKRQKQZQZXDGLV
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2132-1415-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download
memory/2132-1416-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download
memory/2132-1596-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads