Analysis

  • max time kernel
    267s
  • max time network
    269s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    06/10/2024, 09:55

Errors

Reason
Machine shutdown

General

  • Target

    https://github.com/Sn8ow/NoEscape.exe_Virus

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 17 IoCs
  • Modifies registry class 1 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Sn8ow/NoEscape.exe_Virus
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4408
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff81f24cc40,0x7ff81f24cc4c,0x7ff81f24cc58
      2⤵
        PID:1132
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1828,i,16092928825805555954,18379789104626304844,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1824 /prefetch:2
        2⤵
          PID:2344
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2104,i,16092928825805555954,18379789104626304844,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2108 /prefetch:3
          2⤵
            PID:3428
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2168,i,16092928825805555954,18379789104626304844,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2336 /prefetch:8
            2⤵
              PID:4916
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3076,i,16092928825805555954,18379789104626304844,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3112 /prefetch:1
              2⤵
                PID:3044
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,16092928825805555954,18379789104626304844,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3268 /prefetch:1
                2⤵
                  PID:3120
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4432,i,16092928825805555954,18379789104626304844,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4592 /prefetch:8
                  2⤵
                    PID:3608
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4832,i,16092928825805555954,18379789104626304844,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5076 /prefetch:8
                    2⤵
                    • NTFS ADS
                    PID:3144
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=888,i,16092928825805555954,18379789104626304844,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4672 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4468
                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                  1⤵
                    PID:1264
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                    1⤵
                      PID:4980
                    • C:\Windows\System32\rundll32.exe
                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                      1⤵
                        PID:1064
                      • C:\Windows\system32\taskmgr.exe
                        "C:\Windows\system32\taskmgr.exe" /0
                        1⤵
                        • Checks SCSI registry key(s)
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: GetForegroundWindowSpam
                        • Suspicious use of SendNotifyMessage
                        PID:1480
                      • C:\Users\Admin\Downloads\NoEscape.exe\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe
                        "C:\Users\Admin\Downloads\NoEscape.exe\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe"
                        1⤵
                        • Modifies WinLogon for persistence
                        • UAC bypass
                        • Disables RegEdit via registry modification
                        • Drops desktop.ini file(s)
                        • Sets desktop wallpaper using registry
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • NTFS ADS
                        PID:1620
                      • C:\Windows\system32\LogonUI.exe
                        "LogonUI.exe" /flags:0x4 /state0:0xa39e5055 /state1:0x41c64e6d
                        1⤵
                        • Modifies data under HKEY_USERS
                        • Suspicious use of SetWindowsHookEx
                        PID:2732

                      Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                              Filesize

                              64KB

                              MD5

                              b5ad5caaaee00cb8cf445427975ae66c

                              SHA1

                              dcde6527290a326e048f9c3a85280d3fa71e1e22

                              SHA256

                              b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

                              SHA512

                              92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

                            • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                              Filesize

                              4B

                              MD5

                              f49655f856acb8884cc0ace29216f511

                              SHA1

                              cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                              SHA256

                              7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                              SHA512

                              599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                            • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                              Filesize

                              1008B

                              MD5

                              d222b77a61527f2c177b0869e7babc24

                              SHA1

                              3f23acb984307a4aeba41ebbb70439c97ad1f268

                              SHA256

                              80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

                              SHA512

                              d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                              Filesize

                              649B

                              MD5

                              1ed046d3a1cb33b39978e43a7c204e96

                              SHA1

                              5262d5a1b4e53f790b608304558459a82c995d80

                              SHA256

                              7549d3624e66ac9be415945716013aa7cdb11d6aec5de64afb36e099f2e8fd55

                              SHA512

                              03f632fa2843d9f6e439ee53d4dca9f30de251d5f3c0983e0d5b7b5afe4a165d2f9280c7b7f224f1dd0fb67c0975b16178efb2ee598d68903bb6885c31f73217

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              2KB

                              MD5

                              90ce08184e264197df1c3633f9b2ba0a

                              SHA1

                              8465e4137e98abe515f605d8e08b5a840a66ce28

                              SHA256

                              d149a4ab285835ca5c0d8cca6e2218133081e0aa7e5f3cc18856eb02751d024b

                              SHA512

                              232c6a1137b00a7f6b63138c911cfd0e084255e47355d51a673a982bd94340fdccdbc891afb246acc9c2bc082efe1b81c2ae1ce3c030e8793af98f48b93812e2

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              2KB

                              MD5

                              b58c822ca82e6906c908b9c7bab59447

                              SHA1

                              6ed734c53bfecac86d8b382640732a16be82b609

                              SHA256

                              ab1ff14e3ef05d2a0714949a2378a6d92cbe8b2d54dc43856402a2ea277ce807

                              SHA512

                              af878d6b07c46c103be88ef4af1a927c0fddb231fe5b2e11153550142f2d5378995d2e75565518aa2b3a763f545471d887679065e97d22687666045602755500

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              2KB

                              MD5

                              4fae9218ada1931f6772ceec61f83505

                              SHA1

                              d35acbd80502c9e77a2879805c9b0dfb28893dd4

                              SHA256

                              f42ac6aaa4c33315dc93491e9624d420eefa349fa9c637fc9150263024ebf12f

                              SHA512

                              9c361a8e215a7bbdc6a99b2c5a8054ea04e2f8a6f4632a974b4af00dab34b7ed64fc5ade44914cacd5e0169447868609d40a8142377f0712faec25d9123f8bcd

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                              Filesize

                              2B

                              MD5

                              d751713988987e9331980363e24189ce

                              SHA1

                              97d170e1550eee4afc0af065b78cda302a97674c

                              SHA256

                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                              SHA512

                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              60b31f0eb9dc78f535a73b7b10aaed57

                              SHA1

                              299ca171374b21d9587215fe3ae318013e093447

                              SHA256

                              9a878d8863317fb4df939fdf8f370fe7862de31b572bc0e30037e6ac5649ee10

                              SHA512

                              028ea64856d2b64a57d58e54b85873a30a5a1f6e5f270bf59c63169484d7ee7469302be4be0779037ea4454e81929acf3b34669660add934c72130b967963e74

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              940e585dff310daf58e974537ac044e5

                              SHA1

                              cc062505d423a1ea9adec648f80812161bc25d79

                              SHA256

                              b3bd57e8c6899b483466d215d49c422ad9906617c10d93a306cd92cda5acdba4

                              SHA512

                              b02ac025307ccd1c84e7ea0f665147a747d60bd745336d209eaebe0d6cde55ff0832ca02883987a9bcf242d1f0488c611e6784d35e5cd6faffc1d23c46e4e9da

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              10KB

                              MD5

                              ba66e85243843639b19ae2ac1765d167

                              SHA1

                              48ef01aaab3b290171db3a7da37659a80af42fc7

                              SHA256

                              7a49a3a8ce4bdd00d65cb387b132b38348f6dd9cf0803236cfe20be8ec973ca2

                              SHA512

                              6aa5b8b8b74863304572f94cacf249eea34d73e1abe2751bb06c685e76ef9ff42c48e2b2456f40f77749fa963fadaf775389bddaaef30a3f82937c55d0b16269

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              10KB

                              MD5

                              3adbb05f8d5522f6b3d4354d3c026026

                              SHA1

                              5460c034c8dcf7ecee047baa189411397615e048

                              SHA256

                              5c739f2ac10736208e9b7abb10c5eff038af9cf89f45e351b30d412f1d96cdf9

                              SHA512

                              c61ea04134f8157cbba22eaa0868a8fd4d0e7681785ed0a63f4df2b9ede817911b284c697e1105bfb40b97b34ae3a0f22fe0ad03cd810549388e3468e905d33e

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              10KB

                              MD5

                              f1ec79bb63d45804836218e9558564a9

                              SHA1

                              341caee3ba3909746963f738415e6f1c199d6748

                              SHA256

                              8d0034b37e06ec3c9ca5850ea8c10fe04de10ec537b4ac6b780e29798d70c2ea

                              SHA512

                              c94dfcf0a6f8a297831cf9a71875ddcb26d440a8f709a95b721859fc05cd01bc6717caf09fd5416b4e002d5c3db13f0f2acf94fcb5f8f2b883fe85914b572506

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              10KB

                              MD5

                              b9097eb7c549627e41939911768a6e45

                              SHA1

                              4e86dde367e44c51ae8a144ffb77ebfa75b853d5

                              SHA256

                              80433191d2ed64bddcc3fe78650b8c469673241f4a0819fce1e352e94cfe3701

                              SHA512

                              dac5779565cbc439d0b675c75bf5b3323020f7259aa5466218a1454c3d8405e14dc236da24418f69b2363d63280d0cd85289bb31700cf42e9144f58f8d7af988

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              2a9ab22c7054aad319c9b3559f071501

                              SHA1

                              ff968736ad573ce76186b2f158930240e448b992

                              SHA256

                              1de42ae627147993dd095ce16e886bc0cdcfa507984c8ef1767d564887af456d

                              SHA512

                              89cf4c3b79f260368a24025329ffe95299beda613d79815f0865e6bbf164dff4ffe7566b76d40167f05112156cfef12770bc2a73a51be44d6dcbe23dddd205d4

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              0f473212145b995206419fabaac09e3a

                              SHA1

                              2b5fcba51aaa4cdb1b52b6ff78b03ecf03ab3e5f

                              SHA256

                              80a4a64fea86911c9779508c46fd8c88468899dd24131282428a27db99bc63b1

                              SHA512

                              9e6de9aaa460bc2fe4aad888651ce1343abc58d4a6ea07222117aaf8f5a1432bc667da214502b2247d8fdcbeeb3a430e4b4c9af92ead4808cf24b84b1210c749

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              10KB

                              MD5

                              74170e0f0b1e5546e11cd8f76993d180

                              SHA1

                              4f380c317f0ccf63aac8fcef31f38096dbddc041

                              SHA256

                              efbb34f9106969c460c5ba89b877610763df1243fdc94b8827ee88dba6545df7

                              SHA512

                              e762184a887bad94a6761304513394962175e380a49b53b530c7e378817305f9705654400c3abdf3da3c0ca66a55bd6fefbd3014f786fbfbb39edce13028de65

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              10KB

                              MD5

                              96c0531548133d95e970aee04fe097b2

                              SHA1

                              c3c198cc80a662bed0c4b413677d84824f488bf2

                              SHA256

                              999139fe71e04364a5aae6e43834239ec06dd42c147fff2b2adf9ac565d30d16

                              SHA512

                              9a68ed5c2a904ead0d68ef79ca64d5b842421819b5609d16db5c6855a47076feeec1724e946ae38e7529b7da2671ce30a490129599d78301d744813aaee4dd48

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              e8dbd2027f7ffe16b5bbe72a75ae5f4d

                              SHA1

                              3f34cafa234f3810b09e80e877036923061018c7

                              SHA256

                              eb00e87d74789d6681104812d2fc34641de71e412b152532c542e57fd341d251

                              SHA512

                              314293a57e1564530349b029c020e069629dc738348ea13a9e6631f69e6dea3543d11c647691a505e85c4cc6b1e22296ffb25c66f52f23907843a8404fd7c79b

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              10KB

                              MD5

                              b419dca5bce0ba881e7e21aec1b59342

                              SHA1

                              59e66eab4d656fa41f558a81b36234eedb8cbd3f

                              SHA256

                              6e402cfd51837e1ad19bd6e4243277bf01e048cfda9d0fb3171e22ddd45b4c7b

                              SHA512

                              322eb5c205db23d77a15b648388846868ada835109a3a29a184ce53c3b5b60966d1353e22aa54f7ede5948ec4198e8d74fc1f84508793c94f0a36ac895143529

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              10KB

                              MD5

                              b282a11229a322d1fb7173e0098c0290

                              SHA1

                              fa79bdfddecc0a1eff29b38aaa004d0b9eab7712

                              SHA256

                              7046f9aecf16a9da4bbb532100288b6aa36ccdda20d2badf7511d95ea5cf7192

                              SHA512

                              8e4070de733c4fadaacd66f757f95c4b615edbce67475e70eaeb06cfc669fcdf34896375d13d57a1034c37850b78b77d3415cb4cfb3b267beb327e30a415683f

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              10KB

                              MD5

                              3d6659c9baf3881548b4ed401341ba23

                              SHA1

                              439c7190377911dc830dbc91e78aa2f06ba9cf09

                              SHA256

                              2c185b47a68e42330b95391b6977b020004b93d87accadc552b24687fa2419b1

                              SHA512

                              e517abfada06ddd2e51a60d5ef1c8248ec98a1c07812dbdeb5f66169420b438a12ce06ec0fdb044a672b69cff2777dbf7ee60cfeebb398097653b1835a787eea

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              008f892383cf0ca1da0643efe0e48e43

                              SHA1

                              f4f309c5521b6ff838eff707cd212d54e510c0fb

                              SHA256

                              f28822c23b283020bd0c9a61c797dad6e91eaea1a773f5c438a897d97c5ef4d4

                              SHA512

                              30d5b70e0f493f52c0d6fc23555e71317c0aec34c12cbe74050fb38a2eead63b08fffbdbc7b05264d48c558a53a8fe6728c4b327faaa5fe192a5436461b81383

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              10KB

                              MD5

                              ec1b35b624ffd518ae54515a5549a530

                              SHA1

                              f0f0bb6fec147b3929dcafc209165449c1e3e0d9

                              SHA256

                              c2a3afd063e2dcbdb89d29cec30b1e29fedd404e6e6f5624424e11c5af433e71

                              SHA512

                              fbcb845ddb95bfcfba34d43cfc6e462a0bd49c03226ec7f73c674c173b1af4d68f7d4583ff5f05fc0a093aae788f9f63d4cead492d02d842d043602a641473b2

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              10KB

                              MD5

                              d49ef5385475d6f460316810a5451ac5

                              SHA1

                              eb309e6b589effa98fb0deeae6e7f940da5a7f36

                              SHA256

                              c55d72bc2f115c8688176f6c4be5a4b8da0f2f90b18319e72a73763520ac6a96

                              SHA512

                              ee0652fff187dec7cb5d4db39652eaf62f84de8822e023fd75e4fb14bd6176657913452f5b08dc624a7c2f9d43504fff3d61cf8b043d33387739bda2a2d27b1c

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              10KB

                              MD5

                              7b2c8fa9ba1828fa12723f952d38bf21

                              SHA1

                              573f14dfc06d8a1f09cf41171a1d067c9e08bd51

                              SHA256

                              739b2a1f3d9b953166899c1ee6889e4f072a7adc6ac811c481ab0a160a2d15e9

                              SHA512

                              b6064ab706c3da2796f049cb5ff157f3f1d0d11ff5e3bccbf82ec9ff1239a6db6a5557b42205d9194e95d6cd159c44a3273b36ea49db3498ad223e1134181eb1

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              10KB

                              MD5

                              ebfe54d80c5a176f4df6ccc6d868dfde

                              SHA1

                              02c46a5cf025cccde9407a68660ea35ab3b7b51f

                              SHA256

                              44228cd76cb61d92cf2d980fdcc8a2efd327049fbee5ceca621402694ee30288

                              SHA512

                              912fec167aa94dcaa33d963f62ff5bee510ef49605d3818fda99ca2b2a5ba7a5f7d24a078503f986dbae504b809b08ece475dad9ab0fd3e820a15ba0350ae45f

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              99KB

                              MD5

                              33542914e91eba9785edb207072bf6bd

                              SHA1

                              e82e8177b21d0e3a1c24651c5750446fc2cf5bfe

                              SHA256

                              fafdba9971f133eb0fa60a64afef6c6ff74e89169f83e94bcbc2d45ca2be7689

                              SHA512

                              b50aaa43395bb3c1a3452214ecdcf87fd1c70446ddd556196125d056427df977a546c8e6b8f545e7babf2ef211ad0466dd09a615cb9eabba77015b5f35edb4c3

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              99KB

                              MD5

                              db2076a039687bc1cfefd370ea02161f

                              SHA1

                              5c72283c00ffe595fe24ca8de3b689fe6b64324b

                              SHA256

                              d88021949bb367f0bf997b1ae3326f25cfd08380bc7bb264d76e75a832e7be4a

                              SHA512

                              42e8e5571a954b463dc6c4fe053c568a2a26732d217b09bdd9fe182b7ae9538a8e2cab00b814444099119214fa6482326c48e2c98827c8d34d1d835e43832825

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              99KB

                              MD5

                              4d6059f4c5d7fcfb104892bccdb32d00

                              SHA1

                              60acb10153a46e96b8971b9727eca04d88f3b11f

                              SHA256

                              65c423f613e79d56020b172b6b67ad8ddfc9626d3d3a99830ecfcf0c590532d4

                              SHA512

                              4f837bcf545d7ba33856fd40224ec46e237c8e2c3d8145e799a6a73d171ddf4ff9ea3ee453cc0d2461594378b7512935b3058d10dd35e38b7e92b094d809441f

                            • C:\Users\Admin\Downloads\NoEscape.exe.zip.crdownload

                              Filesize

                              13.5MB

                              MD5

                              660708319a500f1865fa9d2fadfa712d

                              SHA1

                              b2ae3aef17095ab26410e0f1792a379a4a2966f8

                              SHA256

                              542c2e1064be8cd8393602f63b793e9d34eb81b1090a3c80623777f17fa25c6c

                              SHA512

                              18f10a71dc0af70494554b400bdf09d43e1cb7e93f9c1e7470ee4c76cd46cb4fbf990354bbbd3b89c9b9bda38ad44868e1087fd75a7692ad889b14e7e1a20517

                            • C:\Users\Admin\Downloads\NoEscape.exe.zip:Zone.Identifier

                              Filesize

                              26B

                              MD5

                              fbccf14d504b7b2dbcb5a5bda75bd93b

                              SHA1

                              d59fc84cdd5217c6cf74785703655f78da6b582b

                              SHA256

                              eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                              SHA512

                              aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                            • C:\Users\Public\Desktop\ზᐑὥ⬿Ꮧ௩⿑ᜭ➪⚔෮⩝෎ߦⰊᶑᎫदᚃ៰ࢰⵔቑۥᔞᴖプ

                              Filesize

                              666B

                              MD5

                              e49f0a8effa6380b4518a8064f6d240b

                              SHA1

                              ba62ffe370e186b7f980922067ac68613521bd51

                              SHA256

                              8dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13

                              SHA512

                              de6281a43a97702dd749a1b24f4c65bed49a2e2963cabeeb2a309031ab601f5ec488f48059c03ec3001363d085e8d2f0f046501edf19fafe7508d27e596117d4

                            • memory/1480-277-0x0000029CE07B0000-0x0000029CE07B1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1480-283-0x0000029CE07B0000-0x0000029CE07B1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1480-284-0x0000029CE07B0000-0x0000029CE07B1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1480-285-0x0000029CE07B0000-0x0000029CE07B1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1480-286-0x0000029CE07B0000-0x0000029CE07B1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1480-287-0x0000029CE07B0000-0x0000029CE07B1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1480-288-0x0000029CE07B0000-0x0000029CE07B1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1480-289-0x0000029CE07B0000-0x0000029CE07B1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1480-278-0x0000029CE07B0000-0x0000029CE07B1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1480-279-0x0000029CE07B0000-0x0000029CE07B1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1620-397-0x0000000000400000-0x00000000005CC000-memory.dmp

                              Filesize

                              1.8MB

                            • memory/1620-574-0x0000000000400000-0x00000000005CC000-memory.dmp

                              Filesize

                              1.8MB