Analysis Overview
SHA256
2870e26f93e1f447a8f39d6924ddfc95895232a06508a5c5bd67f2e89631bf71
Threat Level: Likely benign
The file New Text Document.txt was found to be: Likely benign.
Malicious Activity Summary
Drops file in Program Files directory
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Modifies registry class
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Modifies data under HKEY_USERS
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of SendNotifyMessage
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-30 14:12
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-30 14:12
Reported
2024-05-30 14:17
Platform
win10-20240404-en
Max time kernel
288s
Max time network
300s
Command Line
Signatures
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files (x86)\hello.bat | C:\Users\Admin\Desktop\No Escape.exe | N/A |
| File created | C:\Program Files (x86)\hello.reg | C:\Users\Admin\Desktop\No Escape.exe | N/A |
| File created | C:\Program Files (x86)\mover.exe | C:\Users\Admin\Desktop\No Escape.exe | N/A |
| File created | C:\Program Files (x86)\mypc.exe | C:\Users\Admin\Desktop\No Escape.exe | N/A |
| File created | C:\Program Files (x86)\shaking.exe | C:\Users\Admin\Desktop\No Escape.exe | N/A |
| File created | C:\Program Files (x86)\ | C:\Users\Admin\Desktop\No Escape.exe | N/A |
| File created | C:\Program Files (x86)\hello.jpg | C:\Users\Admin\Desktop\No Escape.exe | N/A |
| File created | C:\Program Files (x86)\msg.exe | C:\Users\Admin\Desktop\No Escape.exe | N/A |
| File created | C:\Program Files (x86)\date.txt | C:\Users\Admin\Desktop\No Escape.exe | N/A |
| File opened for modification | C:\Program Files (x86)\ | C:\Users\Admin\Desktop\No Escape.exe | N/A |
| File opened for modification | C:\Program Files (x86)\ | C:\Users\Admin\Desktop\No Escape.exe | N/A |
| File created | C:\Program Files (x86)\erode.exe | C:\Users\Admin\Desktop\No Escape.exe | N/A |
| File created | C:\Program Files (x86)\launch.exe | C:\Users\Admin\Desktop\No Escape.exe | N/A |
| File created | C:\Program Files (x86)\ | C:\Users\Admin\Desktop\No Escape.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133615519537310647" | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies | C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1" | C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content | C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History | C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" | C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix | C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" | C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1" | C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache | C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings | C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache | C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "51200" | C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\mspaint.exe | N/A |
| N/A | N/A | C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe | N/A |
| N/A | N/A | C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe | N/A |
| N/A | N/A | C:\Users\Admin\Desktop\No Escape.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\New Text Document.txt"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffcb6319758,0x7ffcb6319768,0x7ffcb6319778
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1544 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1844 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2120 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2920 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2928 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3648 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4444 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4616 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4744 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3212 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5352 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5636 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5708 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3156 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5828 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3232 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Users\Admin\Desktop\dnSpy.exe
"C:\Users\Admin\Desktop\dnSpy.exe"
C:\Users\Admin\Desktop\No Escape.exe
"C:\Users\Admin\Desktop\No Escape.exe"
C:\Windows\System32\wscript.exe
"C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\F090.tmp\F091.tmp\F092.vbs //Nologo
C:\Users\Admin\Desktop\dnSpy.Console.exe
"C:\Users\Admin\Desktop\dnSpy.Console.exe"
C:\Users\Admin\Desktop\dnSpy.Console.exe
"C:\Users\Admin\Desktop\dnSpy.Console.exe"
C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ReadTest.jfif" /ForceBootstrapPaint3D
C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
"C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe" -ServerName:Microsoft.MSPaint.AppX437q68k2qc2asvaagas2prv9tjej6ja9.mca
C:\Users\Admin\Desktop\No Escape.exe
"C:\Users\Admin\Desktop\No Escape.exe"
C:\Windows\System32\wscript.exe
"C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\C37B.tmp\C37C.tmp\C37D.vbs //Nologo
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 142.250.187.196:443 | www.google.com | tcp |
| US | 8.8.8.8:53 | 195.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| GB | 142.250.200.14:443 | apis.google.com | tcp |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 8.8.8.8:53 | 196.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.212.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 215.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | github.githubassets.com | udp |
| US | 8.8.8.8:53 | avatars.githubusercontent.com | udp |
| US | 8.8.8.8:53 | play.google.com | udp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 8.8.8.8:53 | github-cloud.s3.amazonaws.com | udp |
| US | 185.199.108.133:443 | avatars.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | user-images.githubusercontent.com | udp |
| GB | 172.217.169.46:443 | play.google.com | tcp |
| US | 8.8.8.8:53 | 154.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 46.169.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | content-autofill.googleapis.com | udp |
| GB | 142.250.180.10:443 | content-autofill.googleapis.com | tcp |
| US | 8.8.8.8:53 | collector.github.com | udp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 8.8.8.8:53 | api.github.com | udp |
| US | 140.82.112.22:443 | collector.github.com | tcp |
| US | 140.82.112.22:443 | collector.github.com | tcp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| US | 8.8.8.8:53 | 10.180.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 210.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.112.82.140.in-addr.arpa | udp |
| US | 8.8.8.8:53 | clients2.google.com | udp |
| GB | 142.250.187.238:443 | clients2.google.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 238.187.250.142.in-addr.arpa | udp |
| GB | 142.250.187.196:443 | www.google.com | udp |
| GB | 142.250.180.10:443 | content-autofill.googleapis.com | udp |
| US | 8.8.8.8:53 | codeload.github.com | udp |
| GB | 20.26.156.216:443 | codeload.github.com | tcp |
| US | 8.8.8.8:53 | 216.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| US | 8.8.8.8:53 | google.com | udp |
| GB | 142.250.178.14:443 | google.com | tcp |
| US | 8.8.8.8:53 | 14.178.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.github.com | udp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| US | 8.8.8.8:53 | 11.179.89.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 162.50.123.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
Files
\??\pipe\crashpad_192_HJEQHLGQEMPQWAGP
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
| MD5 | 99914b932bd37a50b983c5e7c90ae93b |
| SHA1 | bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f |
| SHA256 | 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a |
| SHA512 | 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 08c88b5426e2c8afc21c5f9bbbed8173 |
| SHA1 | ad8501208effe94440e032396d884ed1b783465a |
| SHA256 | 6d152c6cb9208beee78e41c9a812277190fecd3210f21980b49d058615b4ef9a |
| SHA512 | 3e0b28dfe6b1cbc21230912c68f94b7411e421e7b6b5fe13ad02724b17e817a21cdb27d1e611e4a1a2bf85a346960b66e397573e618bb326249cfa72bf4fb6dd |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 90502bbb28b805a355487a578f826227 |
| SHA1 | e644baf33d0bb712273ac41cf1937e823a6482d8 |
| SHA256 | 83a2b1698e8803d0cc3e1ef9e77104124a48bfeeb305674a16ad0ce4ecd63b9e |
| SHA512 | 14b33494b05b5cc861e51586748be7508c48650b7d3bbcab994f0e8c27fc500395094540e677918bff15864e25f213fb056ad1b765e15cab6e79434ff408b7c4 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | eb35cefeeb25c85f34767189388a953e |
| SHA1 | 58250e239ef9049a250d3d3ad01ceedd1a7856b4 |
| SHA256 | c8d4ef2e55a90435a86438cfc126d0f101898d8f1263778d97a0a7646f52705a |
| SHA512 | 10a21975bda9cf6afd7fc3849adf41df4569e7f9643a5b19d45a79160334cd4feb57bbe9075ae18683ccbc15dc7cb32a55ca05f6fd44a6cc56a1d4fea27c8cae |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
| MD5 | d5eda6f7bc8d35da4f0d14baebe36f5f |
| SHA1 | a637c548698edf66feecd8d8ae696e855f048278 |
| SHA256 | 60cfe7f177baaf3e797ee2fb9e12380e1db70bf82d5eb20c4ceb86a2556d4a8c |
| SHA512 | e93ea4c574745c54ea38dc33603b12c6503d8f41ad450eea410b089e8bfc8ab79cce52e7b434c19167db3bdf995cb9aff52d7ee99cf1a0de814dfc8843e6a900 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 8301c335c4a9db22059722cf30a5e752 |
| SHA1 | dca59b2cbf22b5687a0b7de19fac976cfb3eed4d |
| SHA256 | c392c1cf087c38c686c1fae50f062395272da6791c964e43bf3a05d6a236e124 |
| SHA512 | 5a36182ab10b2b4535be7c2d0c18e4b7c018175faf183c20130e79547e03fc4db6229c3f952f7002ff211fa8ee4af51644037ce3a3427c6feac6dfd132a8680b |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5800d6.TMP
| MD5 | c8034626e49ce89c653bb2971f37a65e |
| SHA1 | 7afbd21d54ee65f6820b6b888d0f6f8d7bc3c959 |
| SHA256 | e04bc7de1f01e6ada9de0b238c0169c73bef03031ade70b6feefadc797ff5f70 |
| SHA512 | 9b457cf048ba694161ffbd44a571bacad0bad42251ee3183847a8903a0d749d2bed021b4f25225c84b6e6d8b4ccccfae83f06ef8a707b4a676c55442923eee26 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\af2df036-5cb0-4fd5-8dcb-31eb63abaf24.tmp
| MD5 | 939bbacc9101e87e62b3c058eb90f0e6 |
| SHA1 | 8a794f8a8cd71c2d5ef05b0adb8cb92d1e933ff4 |
| SHA256 | 6b3a8b4b34b7c5365fe8d6f00324b62548750ac24af183f05b083468049ac361 |
| SHA512 | e2f945ff7ae1cf8c24bff793411e2f508d55f9b9e7314820648837154448e403fa88670350f963de74f0181a53d05067b0bf1db8b9baf478ab2b11132b5f7779 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 25a032c33b74ee11c7819effab118b1d |
| SHA1 | 23f11bc50c7f5f1516eef06f3c5f4b60d263c27b |
| SHA256 | f33c77cc997c04633278a5a55e58bc9230d6fe9935544005f7a1c6383be33c25 |
| SHA512 | 04d58eb6f34b1c1bb9ecf7773e309711b1bf5a26175775f2fd9d1301119fa2297517977e169c1d69fc671cb0e6ead84335720159b8026e63adb978c4b7ccef84 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 4743f1d652cf490ba84528b86c8bb0fe |
| SHA1 | 5924713021cc692a58fc7addebb8ec3dfbbdb6e3 |
| SHA256 | 8d094f37e8ef846cca39841a6651906a7089d3be817386fa7e1fbaac9d9f4b50 |
| SHA512 | 230484082eb79cf5015ce11ae921f3aaf9eee340512da846866d5f0c1ad550a0dc72f814c12dc2556d99a2dd597327875a78d6550e2c29969b13adad8fe33d98 |
C:\Users\Admin\Downloads\NO-ESCAPE-main.zip
| MD5 | 9172731ba3f16b578bcb14000ccbccd4 |
| SHA1 | e7ab716661ed88ecf060dc5d53720877b141eac9 |
| SHA256 | ce0a32e35b7c79e7e2ffe7bd3c7566a6fb843341268ad50f4a594e56e17a5110 |
| SHA512 | 3a35995b6dadf408ca69699220120bba5f70fb3c2a850165ab11dad03821c8ce316bf7e9662f8976e0bf659cdb9adf0c8d0d7beca22b59480e4830dc5e02666c |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 32b06a5e05326d12c0edca589dc64044 |
| SHA1 | 1462285936632cd753fda69938ef0840f7ebc8ab |
| SHA256 | c6d900c2427a63ddf9f9ce3f4434e429a41bdc1ce604a687739666ff61a1b04d |
| SHA512 | 4a61fc5d3f91ab35ac2a15e40f0a711395b2495ecd8aa8b8aa94d270f8a81d86c1ae46d046a63b3cdf0c49b2db1dbdd1a1f928b59ecced3413e6af6301c0988c |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | 36434d4f33b3e74535a4ec27c9165841 |
| SHA1 | ee7fc4e89eb7f546390cdb80c28739881c8b3523 |
| SHA256 | 19488f4dab722d120859e1f43f351dbef27f195b529d9efc04baabf1355621b4 |
| SHA512 | e1a4202071b5462ebedd4848fa218736cec049321c36c892e15a49dec4346d358ac5039252694a6dd07d41ee8e652a403fc7d4e70bd216f30f598ddd413624cb |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 66a60a681141a5bff9a5ac393055b27f |
| SHA1 | 55bc1fe0fec29491c64f4daf06e9a647b284265e |
| SHA256 | 3de6b39041b742b0567a1ccb53b8863f41c9160564340f5b84c9144f7b8565f1 |
| SHA512 | 3163935d9eedfb0cd7aee0ccc818fb1bb01a4b45bf802043fe04877849679f5578ee75b0bd9d1d84591b89073e2cda04e277ee212a58ea06c4efeec2c42f8fbf |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | b396ec8a983ecefff0789d55d1afc619 |
| SHA1 | 9b83b7b3266886162c6b416d2c2b4eacf25f1219 |
| SHA256 | 86ebc8a8daeea4903b293035aaf59b0d5e575569a514d5f06d6626db5ef14e2e |
| SHA512 | 7f39de9c96f8092867e88306fd257841095626353003fc4892d7894db7b6ebc7cf599dd25d62b00e8a787931c2910d857b3ee96bbcdcd277540a2d1dd2bc1759 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 0c26bb7bc4709e45c6cb3a08f01d8541 |
| SHA1 | 99dcd3f409d646636d70e20178968594fd984818 |
| SHA256 | c53c3e00d8609adc1068a3f5f5eb98de5c70eb4c1be10186ff82e11810cb4313 |
| SHA512 | 6170d84f419468962d4f5c7c9d964cd740f6986c6d09afc4447f6af0561f5372bf42dfabea671e6998bb7b68d33b027b29e42cd40334f6c74eff581be9557f2c |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
| MD5 | 672243ce3ceb7937f9cb2cf639bf5d1a |
| SHA1 | 7581253e6e141a3067be79aad72b5a140a6a465c |
| SHA256 | eaf127a759d70e3aa058c44027457892195d9c7dc5005f8e6c103bb71d477438 |
| SHA512 | 75fdea3edc9d359daf7f95b8bc1bf95bfc5df05df050c6c72e981af2ae082fce3ec9d48eab02995b992574f3371fa211fdd1411577c280c96ec2d765101e0b7a |
C:\Users\Admin\AppData\Local\Temp\F090.tmp\F091.tmp\F092.vbs
| MD5 | 67706bca9ceaba11530e05d351487003 |
| SHA1 | 3a5ed77f81b14093a5f18c4d46895bc7ea770fee |
| SHA256 | 190a0d994512ed000cf74bd40fb0502988c2ac48855b23a73fd905c0305fc30f |
| SHA512 | 902ac91678d85801a779acbc212c75beba72f8da996b0ed1b148a326c2dd635b88210f9a503fbbffa5271335483eae972e6a00acbc01ec013cf355c080444598 |
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json
| MD5 | 8a905436e93b70cb2d01a128bb958829 |
| SHA1 | d8275216e7de3489a3414f842375003829421687 |
| SHA256 | aa3cea12a708e640b12d87d7f3d91ba54f7f654f34c2b6659a509f311f647b92 |
| SHA512 | a8c3e1ee8481a3dc0e5464b50670551398d74f94eff5e97ca82fcee2bcadfe144ae98537fd15c9a3951b154a3fe9da43c87d1b88ed56ae01d6e76d5989572b64 |
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.json
| MD5 | 404a3ec24e3ebf45be65e77f75990825 |
| SHA1 | 1e05647cf0a74cedfdeabfa3e8ee33b919780a61 |
| SHA256 | cc45905af3aaa62601a69c748a06a2fa48eca3b28d44d8ec18764a7e8e4c3da2 |
| SHA512 | a55382b72267375821b0a229d3529ed54cef0f295f550d1e95661bafccec606aa1cd72e059d37d78e7d2927ae72e2919941251d233152f5eeb32ffdfc96023e5 |
C:\Program Files (x86)\date.txt
| MD5 | 255a8e245b6ad378558b90cbe3dbc3d0 |
| SHA1 | 6eb73f9f2034c113a2a6b1aab9a440a21928cfc2 |
| SHA256 | d3195bde888f9b8a71f2eb840222f1586b652d0ede9f39841a180ead03633ca9 |
| SHA512 | 67e03d7bffa0dec32535b6da46d5b7f38d94a7c9a231aa2fa625b81485d41c1ecac95b08fe5b7a605fcfe1c7e37c55ee716c9045df90ea6e030b86e52ec09edf |
C:\Program Files (x86)\shaking.exe
| MD5 | 414b8d5fe6f1884a9c7d2091b03f8057 |
| SHA1 | cd9ebd4dde7f57386d1cf74799a09bca6c42d4a1 |
| SHA256 | 993bb01dbdea38e63ff38b27907d0955e45a9cb340fd2e3f335e928b5e051172 |
| SHA512 | d8ec34e14f00403341fcb7ee3b3ba6ea2e400fac3cd6258d6de1180ddd21fd3d5efaf1b0d43ca3172e9e4b7735d4ba36964253bc9992924a9cf9f24a7f1be7d8 |
C:\Program Files (x86)\mypc.exe
| MD5 | 3cf9a7a431df42a5758133da6236ea8c |
| SHA1 | fffc40f796107f69c367d9381bb45d0902459f5e |
| SHA256 | bf21063cbd788f2dcd06b5fe925e9a2bc5f26fdd6869c6260464e8cc6e0cfb60 |
| SHA512 | 20909c792d5ba7a0f2b86f7e5fe6d7d91d5674be5108378cd26c11fb5688d5ceeee0a960e72f7b59d6db80f693f637af6c19b89491b97ea918e996ff200d76bb |
C:\Program Files (x86)\msg.exe
| MD5 | 331a0667b11e02330357565427dc1175 |
| SHA1 | d84c1ae0bf2c8ca1f433f0086ca86e07f61204c2 |
| SHA256 | fc7174e44a1d34040c3bc05ce24e648742a38a3accce22e8300d7059e4d12431 |
| SHA512 | 1c47f0438dce58d473d93c10f233650df3e86d7e762a08b3a933da37683e76a079d275db4a1b4028d903f7e43f487173ba8bb25c4cff6f3e1161d0a5b2b18cec |
C:\Program Files (x86)\mover.exe
| MD5 | ddcf5d5ce2600c1137445019ed8b465b |
| SHA1 | 49ed7183e91d362fff023ccb51af9a1ea86d9b95 |
| SHA256 | bfbc70655122e7f6d11ec954d8e2836771ad6aec78e70a5564d03202de4f07a3 |
| SHA512 | 15b3f91cf370b6742041a5dcec4395193ed0f45546a9bd7109f9e699be8c133472630f8193e5c7e97566048e66478e99fdbc10af077d6f9212dfbd6ad0839d69 |
C:\Program Files (x86)\launch.exe
| MD5 | b4acc41d0e55b299ffeec11a8a20cf08 |
| SHA1 | bbee20882bdd9dcd24b54b6af6c48cf5efc8c6fa |
| SHA256 | 34bc0d5b6029a74b9cda56b72434ec1b55b6742ff5ef832d36027a987a63cd42 |
| SHA512 | d4fa9900d703ea12d508929718433f97581a23b63458e5070ff7749871a7f60889db45098ec2972687b864ba97ab4fc307e8c80c4450dee79c0a5738818d2794 |
C:\Program Files (x86)\hello.reg
| MD5 | 81427e9d5d10657b9edffd22e7b405bb |
| SHA1 | f27ab62f77f827dbb32c66a35ac48006c47f4374 |
| SHA256 | bb21001c1c468e6e372d836952c3efb7fbdc98e9a20a1bfdcc4beb1b7a1e7f83 |
| SHA512 | b0ee65bcef13be7c17db6e06b96cd44774fcebe6f4a411b0073493ff53f795e3b7c49e921c3bd2e41256638bc161f5218d1c51b589c3e10164f8f2c0d1db1592 |
C:\Program Files (x86)\hello.jpg
| MD5 | 057ea45c364eb2994808a47b118556a2 |
| SHA1 | 1d48c9c15ea5548af1475b5a369a4f7b8db42858 |
| SHA256 | 6e1115188aa00fb5ff031899100bacb0d34819707e069bca3eb53935ebb39836 |
| SHA512 | 582c7ecf2d0c33c8706ff3f39aa926780aa8f0dc0ff5d563905a5100254b81b89def22206abee0871ab339a3d463de9e6ec1782d92198e8f386f173654b6e760 |
C:\Program Files (x86)\hello.bat
| MD5 | b86fddd2b764f079615be5d4dc3e158d |
| SHA1 | 2510479054db1fe52cc2dcd3c7033d91204cb367 |
| SHA256 | 2b2114784d15b0b0d5475256851b4d0d4da7181198c2a93a304ecedb98eaf091 |
| SHA512 | 915363bc9f6e665358c8d25f5f5f51d64c53cb755be999013217162b126705ce641ea809047bc84511db7e3e383b848ec3932924baa8926d51a51d0037a5ca63 |
C:\Program Files (x86)\erode.exe
| MD5 | 918e75eccb1e25e1d73994b975ef252c |
| SHA1 | 22b2a0823c0e8109323a405906bd5abe1df7319b |
| SHA256 | cba73a620b7d4143830320f0878a473d1195d2c8aeee65f0aeee235a689de48c |
| SHA512 | 333208195dc4dba0abb357a53d77593f9818822187f7da86db1dda423e02d4d68fd77044b21d18808bd8acfae4e93d7c41bf34f1c29f78e5ba5d642cd6587147 |