Malware Analysis Report

2025-03-15 08:19

Sample ID 241020-wbhtps1drd
Target rxvengeissuchasigmarizzler.png
SHA256 db85d889b361fdb82a096fd8b40cb1f4b07fd959abaab4ff56dfc9bce1fbd620
Tags
discovery evasion persistence ransomware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

db85d889b361fdb82a096fd8b40cb1f4b07fd959abaab4ff56dfc9bce1fbd620

Threat Level: Known bad

The file rxvengeissuchasigmarizzler.png was found to be: Known bad.

Malicious Activity Summary

discovery evasion persistence ransomware trojan

Modifies WinLogon for persistence

UAC bypass

Disables RegEdit via registry modification

Drops desktop.ini file(s)

Sets desktop wallpaper using registry

Drops file in Windows directory

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

NTFS ADS

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Modifies registry class

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Modifies data under HKEY_USERS

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-20 17:44

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-20 17:44

Reported

2024-10-20 17:50

Platform

win11-20241007-en

Max time kernel

303s

Max time network

305s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\rxvengeissuchasigmarizzler.png

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\winnt32.exe" C:\Users\Admin\Downloads\NoEscape.exe-Download-main\NoEscape.exe-Download-main\NoEscape.exe\NoEscape.exe N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\Downloads\NoEscape.exe-Download-main\NoEscape.exe-Download-main\NoEscape.exe\NoEscape.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\Downloads\NoEscape.exe-Download-main\NoEscape.exe-Download-main\NoEscape.exe\NoEscape.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\Downloads\NoEscape.exe-Download-main\NoEscape.exe-Download-main\NoEscape.exe\NoEscape.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\Downloads\NoEscape.exe-Download-main\NoEscape.exe-Download-main\NoEscape.exe\NoEscape.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\noescape.png" C:\Users\Admin\Downloads\NoEscape.exe-Download-main\NoEscape.exe-Download-main\NoEscape.exe\NoEscape.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SystemTemp C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created C:\Windows\winnt32.exe C:\Users\Admin\Downloads\NoEscape.exe-Download-main\NoEscape.exe-Download-main\NoEscape.exe\NoEscape.exe N/A
File opened for modification C:\Windows\winnt32.exe C:\Users\Admin\Downloads\NoEscape.exe-Download-main\NoEscape.exe-Download-main\NoEscape.exe\NoEscape.exe N/A
File created C:\Windows\winnt32.exe\:Zone.Identifier:$DATA C:\Users\Admin\Downloads\NoEscape.exe-Download-main\NoEscape.exe-Download-main\NoEscape.exe\NoEscape.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\NoEscape.exe-Download-main\NoEscape.exe-Download-main\NoEscape.exe\NoEscape.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "209" C:\Windows\system32\LogonUI.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133739199434444534" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix C:\Windows\system32\BackgroundTransferHost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\system32\BackgroundTransferHost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\system32\BackgroundTransferHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\MuiCache C:\Windows\system32\BackgroundTransferHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings C:\Program Files\Google\Chrome\Application\chrome.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Windows\winnt32.exe\:Zone.Identifier:$DATA C:\Users\Admin\Downloads\NoEscape.exe-Download-main\NoEscape.exe-Download-main\NoEscape.exe\NoEscape.exe N/A
File opened for modification C:\Users\Admin\Downloads\NoEscape.exe-Download-main.zip:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4224 wrote to memory of 1412 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 1412 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 3032 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 3032 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4224 wrote to memory of 2420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\rxvengeissuchasigmarizzler.png

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff04fccc40,0x7fff04fccc4c,0x7fff04fccc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1784,i,5182399414042618763,11006911863904858059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1720 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1792,i,5182399414042618763,11006911863904858059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2068 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2204,i,5182399414042618763,11006911863904858059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2216 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3100,i,5182399414042618763,11006911863904858059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3248 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3168,i,5182399414042618763,11006911863904858059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3280 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3568,i,5182399414042618763,11006911863904858059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4420 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4592,i,5182399414042618763,11006911863904858059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4604 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4608,i,5182399414042618763,11006911863904858059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4724 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3756,i,5182399414042618763,11006911863904858059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4664 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4960,i,5182399414042618763,11006911863904858059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4968 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5080,i,5182399414042618763,11006911863904858059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4692 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=868,i,5182399414042618763,11006911863904858059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4848 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3448,i,5182399414042618763,11006911863904858059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3276 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5200,i,5182399414042618763,11006911863904858059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5128 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5296,i,5182399414042618763,11006911863904858059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5328 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5500,i,5182399414042618763,11006911863904858059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4628 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5460,i,5182399414042618763,11006911863904858059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5548 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5596,i,5182399414042618763,11006911863904858059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4324 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3496,i,5182399414042618763,11006911863904858059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5456 /prefetch:8

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Downloads\NoEscape.exe-Download-main\NoEscape.exe-Download-main\NoEscape.exe\NoEscape.exe

"C:\Users\Admin\Downloads\NoEscape.exe-Download-main\NoEscape.exe-Download-main\NoEscape.exe\NoEscape.exe"

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa38dc055 /state1:0x41c64e6d

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
GB 142.250.200.36:443 www.google.com udp
GB 142.250.200.36:443 www.google.com tcp
GB 216.58.204.74:443 content-autofill.googleapis.com udp
GB 142.250.179.238:443 apis.google.com udp
GB 216.58.204.74:443 content-autofill.googleapis.com tcp
GB 216.58.201.110:443 play.google.com udp
GB 216.58.201.110:443 play.google.com tcp
GB 142.250.180.14:443 clients2.google.com udp
N/A 224.0.0.251:5353 udp
GB 142.250.180.14:443 clients2.google.com tcp
US 216.239.34.157:443 tunnel.googlezip.net tcp
US 216.239.34.157:443 tunnel.googlezip.net tcp
GB 216.58.201.110:443 play.google.com tcp
GB 142.250.187.234:443 content-autofill.googleapis.com tcp
GB 216.58.204.78:443 encrypted-tbn0.gstatic.com tcp
GB 216.58.204.78:443 encrypted-tbn0.gstatic.com tcp
GB 216.58.204.78:443 encrypted-tbn0.gstatic.com tcp
GB 216.58.204.78:443 encrypted-tbn0.gstatic.com tcp
GB 216.58.204.78:443 encrypted-tbn0.gstatic.com tcp
GB 216.58.204.78:443 encrypted-tbn0.gstatic.com udp
GB 172.217.16.225:443 lh5.googleusercontent.com tcp
GB 172.217.16.225:443 lh5.googleusercontent.com tcp
GB 172.217.16.225:443 lh5.googleusercontent.com tcp
GB 142.250.179.227:443 id.google.com tcp
US 216.239.34.157:443 tunnel.googlezip.net tcp
US 216.239.34.157:443 tunnel.googlezip.net tcp
GB 216.58.201.110:443 play.google.com udp
GB 142.250.200.36:443 www.google.com udp
US 8.8.8.8:53 js.knock-ai.com udp
US 8.8.8.8:53 go.sentinelone.com udp
US 104.26.2.18:443 www.sentinelone.com tcp
US 104.26.2.18:443 www.sentinelone.com tcp
US 104.26.2.18:443 www.sentinelone.com tcp
US 104.26.2.18:443 www.sentinelone.com tcp
US 104.26.2.18:443 www.sentinelone.com tcp
US 104.18.86.42:443 cdn.cookielaw.org tcp
GB 142.250.187.202:443 content-autofill.googleapis.com tcp
US 34.49.80.229:443 js.knock-ai.com tcp
US 104.17.73.206:443 go.sentinelone.com tcp
GB 172.217.169.67:443 beacons.gcp.gvt2.com tcp
GB 172.217.169.67:443 beacons.gcp.gvt2.com tcp
US 104.18.86.42:443 cdn.cookielaw.org tcp
GB 142.250.187.202:443 content-autofill.googleapis.com tcp
US 8.8.8.8:53 42.86.18.104.in-addr.arpa udp
US 8.8.8.8:53 js.qualified.com udp
US 104.18.16.5:443 js.qualified.com tcp
US 104.18.16.5:443 js.qualified.com tcp
US 104.18.86.42:443 cdn.cookielaw.org tcp
US 34.49.80.229:443 js.knock-ai.com udp
GB 142.250.187.234:443 content-autofill.googleapis.com tcp
US 104.18.86.42:443 cdn.cookielaw.org tcp
US 34.49.80.229:443 js.knock-ai.com tcp
GB 142.250.187.234:443 content-autofill.googleapis.com tcp
US 8.8.8.8:53 5.16.18.104.in-addr.arpa udp
US 8.8.8.8:53 145.160.16.104.in-addr.arpa udp
US 172.64.155.119:443 geolocation.onetrust.com tcp
US 34.49.80.229:443 js.knock-ai.com udp
GB 142.250.200.19:443 ca.knock-ai.com tcp
GB 142.250.187.234:443 content-autofill.googleapis.com udp
US 8.8.8.8:53 19.200.250.142.in-addr.arpa udp
US 104.18.16.5:443 ws.qualified.com tcp
US 104.26.2.18:443 www.sentinelone.com tcp
US 104.17.111.223:443 onesignal.com tcp
US 104.26.2.18:443 www.sentinelone.com tcp
US 104.17.111.223:443 onesignal.com udp
US 104.17.111.223:443 onesignal.com udp
US 104.17.111.223:443 onesignal.com tcp
US 8.8.8.8:53 img.onesignal.com udp
US 8.8.8.8:53 232.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 app.qualified.com udp
US 104.18.17.5:443 app.qualified.com tcp
US 8.8.8.8:53 region1.analytics.google.com udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
US 8.8.8.8:53 www.google.co.uk udp
US 8.8.8.8:53 bat.bing.com udp
US 8.8.8.8:53 scripts.demandbase.com udp
US 8.8.8.8:53 snap.licdn.com udp
US 8.8.8.8:53 a.quora.com udp
US 8.8.8.8:53 munchkin.marketo.net udp
US 8.8.8.8:53 cdn.abrankings.com udp
US 216.239.34.36:443 region1.analytics.google.com tcp
US 8.8.8.8:53 tags.srv.stackadapt.com udp
GB 74.125.206.156:443 stats.g.doubleclick.net tcp
GB 142.250.180.3:443 www.google.co.uk tcp
US 150.171.28.10:443 bat.bing.com tcp
US 162.159.152.17:443 a.quora.com tcp
GB 23.204.224.203:443 munchkin.marketo.net tcp
NL 18.239.69.31:443 cdn.abrankings.com tcp
NL 18.239.50.10:443 scripts.demandbase.com tcp
GB 2.19.117.135:443 snap.licdn.com tcp
DE 3.127.102.30:443 tags.srv.stackadapt.com tcp
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 104.18.16.5:443 assets.qualified.com tcp
US 104.18.16.5:443 assets.qualified.com tcp
US 104.16.79.73:443 static.cloudflareinsights.com tcp
DE 3.127.102.30:443 tags.srv.stackadapt.com tcp
US 8.8.8.8:53 static.ads-twitter.com udp
US 8.8.8.8:53 px.ads.linkedin.com udp
GB 151.101.188.157:443 static.ads-twitter.com tcp
US 13.107.42.14:443 px.ads.linkedin.com tcp
US 8.8.8.8:53 cdn.calibermind.com udp
US 8.8.8.8:53 5.17.18.104.in-addr.arpa udp
US 8.8.8.8:53 36.34.239.216.in-addr.arpa udp
US 8.8.8.8:53 156.206.125.74.in-addr.arpa udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 203.224.204.23.in-addr.arpa udp
US 8.8.8.8:53 17.152.159.162.in-addr.arpa udp
US 8.8.8.8:53 34.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 31.69.239.18.in-addr.arpa udp
US 8.8.8.8:53 10.50.239.18.in-addr.arpa udp
US 8.8.8.8:53 135.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 73.79.16.104.in-addr.arpa udp
US 8.8.8.8:53 30.102.127.3.in-addr.arpa udp
US 8.8.8.8:53 157.188.101.151.in-addr.arpa udp
US 8.8.8.8:53 14.42.107.13.in-addr.arpa udp
US 172.67.213.149:443 cdn.calibermind.com tcp
US 8.8.8.8:53 sentry.io udp
US 172.67.213.149:443 cdn.calibermind.com tcp
DE 3.127.102.30:443 tags.srv.stackadapt.com tcp
US 35.186.247.156:443 sentry.io tcp
US 8.8.8.8:53 tag.demandbase.com udp
NL 18.239.50.10:443 tag.demandbase.com tcp
US 8.8.8.8:53 www.clarity.ms udp
DE 3.127.102.30:443 tags.srv.stackadapt.com tcp
US 13.107.246.64:443 www.clarity.ms tcp
US 8.8.8.8:53 s.ml-attr.com udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 t.co udp
US 8.8.8.8:53 api.company-target.com udp
US 8.8.8.8:53 analytics.twitter.com udp
US 8.8.8.8:53 e.calibermind.com udp
US 68.67.153.60:443 s.ml-attr.com tcp
GB 172.217.16.226:443 googleads.g.doubleclick.net tcp
US 162.159.140.229:443 t.co tcp
NL 18.239.50.10:443 tag.demandbase.com tcp
US 104.21.45.116:443 e.calibermind.com tcp
US 68.67.153.60:443 s.ml-attr.com tcp
US 8.8.8.8:53 226.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 156.247.186.35.in-addr.arpa udp
US 8.8.8.8:53 64.246.107.13.in-addr.arpa udp
US 8.8.8.8:53 229.140.159.162.in-addr.arpa udp
US 8.8.8.8:53 149.213.67.172.in-addr.arpa udp
US 8.8.8.8:53 match.prod.bidr.io udp
GB 172.217.16.226:443 googleads.g.doubleclick.net tcp
US 104.21.45.116:443 e.calibermind.com tcp
IE 52.30.133.232:443 match.prod.bidr.io tcp
US 8.8.8.8:53 id.rlcdn.com udp
GB 142.250.180.3:443 www.google.co.uk udp
GB 142.250.200.36:443 www.google.com tcp
US 35.244.174.68:443 id.rlcdn.com tcp
US 35.244.174.68:443 id.rlcdn.com tcp
US 104.244.42.67:443 analytics.twitter.com tcp
NL 13.227.219.42:443 api.company-target.com tcp
US 8.8.8.8:53 226.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 116.45.21.104.in-addr.arpa udp
US 8.8.8.8:53 232.133.30.52.in-addr.arpa udp
US 8.8.8.8:53 60.153.67.68.in-addr.arpa udp
US 8.8.8.8:53 67.42.244.104.in-addr.arpa udp
NL 13.227.219.42:443 api.company-target.com tcp
US 8.8.8.8:53 b.clarity.ms udp
US 8.8.8.8:53 68.174.244.35.in-addr.arpa udp
US 8.8.8.8:53 42.219.227.13.in-addr.arpa udp
US 8.8.8.8:53 327-mnm-087.mktoresp.com udp
US 192.28.144.124:443 327-mnm-087.mktoresp.com tcp
US 8.8.8.8:53 124.144.28.192.in-addr.arpa udp
US 8.8.8.8:53 qualified-production.s3.us-east-1.amazonaws.com udp
US 52.216.214.58:443 qualified-production.s3.us-east-1.amazonaws.com tcp
US 8.8.8.8:53 58.214.216.52.in-addr.arpa udp
US 4.153.129.168:443 b.clarity.ms tcp
US 8.8.8.8:53 168.129.153.4.in-addr.arpa udp
US 52.216.214.58:443 qualified-production.s3.us-east-1.amazonaws.com tcp
US 52.216.214.58:443 qualified-production.s3.us-east-1.amazonaws.com tcp
US 8.8.8.8:53 secure.adnxs.com udp
DE 37.252.171.21:443 secure.adnxs.com tcp
US 8.8.8.8:53 21.171.252.37.in-addr.arpa udp
US 4.153.129.168:443 b.clarity.ms tcp
US 8.8.8.8:53 attr.ml-api.io udp
NL 108.156.60.24:443 attr.ml-api.io tcp
US 8.8.8.8:53 24.60.156.108.in-addr.arpa udp
US 4.153.129.168:443 b.clarity.ms tcp
US 4.153.129.168:443 b.clarity.ms tcp
US 8.8.8.8:53 13115870.fls.doubleclick.net udp
GB 172.217.169.6:443 13115870.fls.doubleclick.net tcp
GB 172.217.16.226:443 googleads.g.doubleclick.net udp
GB 172.217.169.6:443 13115870.fls.doubleclick.net udp
GB 142.250.200.36:443 www.google.com udp
US 4.153.129.168:443 b.clarity.ms tcp
US 8.8.8.8:53 js-agent.newrelic.com udp
US 8.8.8.8:53 js.zi-scripts.com udp
US 8.8.8.8:53 c.clarity.ms udp
US 162.247.243.39:443 js-agent.newrelic.com tcp
IE 13.74.129.1:443 c.clarity.ms tcp
US 104.18.37.212:443 js.zi-scripts.com tcp
IE 13.74.129.1:443 c.clarity.ms tcp
US 8.8.8.8:53 6.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 bam.nr-data.net udp
US 104.18.37.212:443 js.zi-scripts.com udp
US 162.247.243.29:443 bam.nr-data.net tcp
US 162.247.243.29:443 bam.nr-data.net tcp
US 8.8.8.8:53 212.37.18.104.in-addr.arpa udp
US 8.8.8.8:53 39.243.247.162.in-addr.arpa udp
US 8.8.8.8:53 1.129.74.13.in-addr.arpa udp
US 8.8.8.8:53 c.bing.com udp
US 13.107.21.237:443 c.bing.com tcp
US 8.8.8.8:53 ws.zoominfo.com udp
US 8.8.8.8:53 ws-assets.zoominfo.com udp
US 104.16.117.43:443 ws-assets.zoominfo.com tcp
US 104.16.118.43:443 ws-assets.zoominfo.com tcp
US 13.107.21.237:443 c.bing.com tcp
US 104.16.117.43:443 ws-assets.zoominfo.com udp
US 104.16.117.43:443 ws-assets.zoominfo.com udp
US 8.8.8.8:53 43.117.16.104.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 43.118.16.104.in-addr.arpa udp
US 8.8.8.8:53 29.243.247.162.in-addr.arpa udp
GB 142.250.200.36:443 www.google.com udp
US 216.239.34.36:443 region1.analytics.google.com udp
GB 142.250.200.36:443 www.google.com udp
GB 142.250.179.227:443 id.google.com udp
US 216.239.34.157:443 tunnel.googlezip.net tcp
US 216.239.34.157:443 tunnel.googlezip.net tcp
US 8.8.8.8:53 play.google.com udp
GB 216.58.212.206:443 play.google.com udp
US 8.8.8.8:53 206.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 github.githubassets.com udp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.111.133:443 user-images.githubusercontent.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 154.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 133.111.199.185.in-addr.arpa udp
GB 142.250.187.234:443 content-autofill.googleapis.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 140.82.112.22:443 collector.github.com tcp
US 140.82.112.22:443 collector.github.com tcp
GB 20.26.156.210:443 api.github.com tcp
GB 142.250.187.234:443 content-autofill.googleapis.com udp
US 8.8.8.8:53 22.112.82.140.in-addr.arpa udp
US 8.8.8.8:53 210.156.26.20.in-addr.arpa udp
GB 20.26.156.216:443 codeload.github.com tcp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 172.217.169.67:443 beacons.gcp.gvt2.com udp
GB 172.217.169.67:443 beacons.gcp.gvt2.com tcp
GB 172.217.169.67:443 beacons.gcp.gvt2.com tcp
GB 104.86.110.98:443 tcp
US 8.8.8.8:53 r.bing.com udp
GB 92.123.128.174:443 r.bing.com tcp
GB 92.123.128.174:443 r.bing.com tcp
GB 92.123.128.174:443 r.bing.com tcp
GB 92.123.128.174:443 r.bing.com tcp
GB 92.123.128.174:443 r.bing.com tcp
GB 92.123.128.174:443 r.bing.com tcp
US 8.8.8.8:53 browser.pipe.aria.microsoft.com udp
US 104.208.16.88:443 browser.pipe.aria.microsoft.com tcp
US 8.8.8.8:53 174.128.123.92.in-addr.arpa udp
US 8.8.8.8:53 88.16.208.104.in-addr.arpa udp
GB 92.123.128.170:443 www.bing.com tcp
US 8.8.8.8:53 222.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 170.128.123.92.in-addr.arpa udp
US 8.8.8.8:53 28.73.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 331e697ab1478ad64319ba36af88ae37
SHA1 90606a78de9f6b365f49f182bdbae4c919167785
SHA256 46142b0c7c0fab1fba3c2ff43a67d0e9690f399646ec59ce7ca5b013af041303
SHA512 1f54be6ff807def956ec9a8adf5686c80aa08d92e7b76345a276cd969859a1127be65913fb1e0d5e0fadcc6ffc698064986f4a3482a3eeb34e4e939a588be046

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ee4d1484-516b-4c61-9d4c-ecc3cbbdec38.tmp

MD5 2938d2f21c22b7a72b7536a3044d8b01
SHA1 407b92c518b0e6b7b36abb00e32b71931d365f6f
SHA256 8c5ed1e8954d3c98fd2321849dae09a41da98579dde4a56ae2784a56bcf2df0b
SHA512 73a82bb333c58c191fe942267393e58c3727fb3ba0259a2ccdebd37c8ef8db9da42a3e879d173b44e4d8cd975cddb0dd9c01230ea4ca6005dd7af976b80fea71

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 5effa96217d63e59ac4d32f1d23a08a7
SHA1 8d359eb5af8314a844879222395eb9f2f97fa422
SHA256 543a15663b4e913e2be2a88ed3d52fc2e0862b4d3b3b49cde8dfb86c8d2fadf2
SHA512 393a228b2cd11ede16619a99b04a9c857a66bf2fda5f26c6f0f51fb2b3a4a0b823ade24eae08e08f85de7ded3ed1a4edf8418ecd4a9f73d1b00435fdaf53cb72

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 b266c6363e388271d65ef444626cc42f
SHA1 83f0d7dcf9cd1749141a8e01076cc0c0e57e9c31
SHA256 92a11e54346395e0bb27ba654471a8f13894ab9538daf6f977c0d35840351958
SHA512 d57796e0d7174f64f4a663c44daf3969a7e876b52aa57e08554b221410c0c0772fdeae3c9dab0dbadec6307b1e61a462f5d39f965bb06bf7f1a86e4bfc8e238f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 de7df4a43a4f5775392dda3bcb784876
SHA1 1c6012e7478108551b58914ee09dd5af89f0353c
SHA256 0da6c3fd00d4702c866e123390b9c4175ff1324468371e5dec67be69d1e5ba8c
SHA512 186cda0afc0efd6b167b33791e92acb4b0a4b5ebf290496e3a9a290adc622c7caafa73b07e2469506dd4086ff85ddc1f9b5d99da01b6d901c80df8fa0e2beddc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 3d23753a94a03362a165df39f7140123
SHA1 e8d7e833925662bcc38042094bdb9960796dd66b
SHA256 eee2a20bc81d1eb8319af3516d7787011699ce6ec088d7e058f3034c394feb04
SHA512 f7887dd149e47941957c49f440b52a203fa8a1521832c8b4019a5927bbefb11b520b229f92749e5ba3cd535f4ebca7e2ab440a911b9d0b1fb128160db1a0a1ba

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 e670e563afa6ad2b1596ffd59b8069ef
SHA1 1777995db03c02051483c2572e0dfd3136347d49
SHA256 91dbc060a66130c2c72e2d841db202341ae958abc6086757a357c89f90bfb6a0
SHA512 1e260282d69101ee8dbea9b59710e5aae66d37c1d8cae737b449f9e9e420401d81168c7e6fee7df0cd706e6e3062f88d842071bac52183edd3e770db3d438351

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 e359f75e0261eb6b28cb15d4b6db2096
SHA1 0ea5f06457276d0f229b4bb7cb9109ab3fe5f5e5
SHA256 0a67f58baeafcb536124cd52bff0061e5f1144c59d90a5fe7bf26faf6ff63df6
SHA512 e5449d0d9404606d686ec99c32eb8f1b6fb909a396fcbcf0ad0a72ba34e746303ab65c22f35a88cf913d5d5fffe0227997abc54a69f70354f40cb56325e5f3a0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 460950ccf88814255f6868e6bb3ce527
SHA1 c8ff961907ab3d5490dc6714b82dacaddc702435
SHA256 b9acc93ddd13031456314adaafae7a1795862afee2d102a9bbbaf093bc16e46a
SHA512 71fb8091f02e6e5ad7cc98363df2bdb1473f8357bc4ea9f62a7d5b561f867a63d49e453f27eae3e6b81e8f157bee739e6c6e4a8358f99fa116f3b03531afb6e8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 3e99008d59df2f0b93163b3bfd7288e7
SHA1 c2aa749fe97badbeb06f66d4d42cb2b82366d1be
SHA256 633d3964926e7af82a9e8a1a66d5363c5703cc345e0dd733cf83a9e58ac1fdb8
SHA512 c865ae1943056f11ee7ebe455b778f1d1f7820076ad9e5af14c77ec86d9611603d505fc3e6c39ff9f92bfc1e36443258f4959f36f714597201d7ee6fa265d7b8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ab20b632aad8ed81fc4c431256a049a9
SHA1 abf860e00e3ddf140b1da7b1f03b828cbcb3a75c
SHA256 535c733846fd0025316348ad8a80be7d2f69e57ef2dbd6f3c8e0d4e8a517394a
SHA512 84c9592a8c842a63e51fbcb01725f522584e4dea99d1a9e9dd37eb5859ff4b7125c750d803756fca3ffb5fd364d0ff6bd32ed85061c21e38c0fc4c3e9bfd7257

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 46a56fe8508a82a874c8bc079992b839
SHA1 c7c90b1d9f51e2b4d7e929717bee38ff3b2fa3c1
SHA256 724222e77c0503e7089cbdb2f34f348946b8d0c3e9ba90b06b8765af49df73d9
SHA512 658dcab37fd563eea675df4fda528e5f0e3088ef7a876cbe4a887fc7325ade9b2de2a6ebb9e17c155d57f0c37064da0e5dc52a6cb6ca6975d3d06b1e33979e00

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 eb77dfa870f49ac1fb0dfac725a035a4
SHA1 2f0fbc7d5decc57993ae4b42cb746f7c4bb88640
SHA256 9ac1309af1d15cf3e7a13d88e31e0da628a70e52b32cdb5a3a4b2f43a30304a8
SHA512 94dda9ba111e8dc9522dcc3189d5b080f8d6f4c9005432dc808bcdb8ef95aa26d68878cb99639081ac9e16212c0501b85b7d222a55a1b1dbac5e4421e0b4acd7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 a5ca4825e1ab6877f7a4873c9558275b
SHA1 f90546d7ffcf13928a5c08a98b6836cdd5adff90
SHA256 9f9a3303f4c52d6daaa84e8a1a4ebc7ea7da7136984a0fc0c8ef90772a7e3afd
SHA512 c7491fd9a2d00e1e612e8798ba82b27f2c787b98119e209786fda372599f5c349682d81239f1b0b90d77c701f36b0a5075d0662412c42d63650e9dc09d4865ce

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 e1db065e780fb996dabf050aa10ee280
SHA1 91f8f0661cb3c4dedc02a511ca130fdcceaddc5f
SHA256 bab038e2b1b95ef33050771c7d8670b08dd34c71099818dff6935e665a4aa4e0
SHA512 00d987d2d14557f4635cc1c96076a2f407153d839b50f653ee2b08f955a8cec5f601375688e51434a68dc8487edcfd89f08fdb70cb0cbbe4f928ad4fa5e58fa9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 7b40591d4f29345148bd9eaaaa6f9e38
SHA1 4a33daa3c076d3908929392f44b5c56761c7834e
SHA256 b442739f285c3184997914d31fe78c360f4caa497c6f0e7abcc4421ccf631cdf
SHA512 031032e3b18555a8d7a8b6b378937aede182d40dbb84b7be1d980472342c89c092dddddee6795b837744ea173de6c08f0bfaf3a7a764cf14b6c57fcaeb566e2e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ba63020de50c95ff183ba2f83493b15c
SHA1 7d001266d38dcd98c885e9e5964dd472540ca1e7
SHA256 1ebf36da30233a83d65a95460d439018245dcd84aef566e372fc6ceeabbf2d65
SHA512 a00fad25402638df864f2c2503f7271fa3713b5c7c94047de1be91e3aa430c41cd6a78e6f806926b6d8d52f9a60b7b271beec29279d2a401e20d1a308cda0025

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

MD5 b5ad5caaaee00cb8cf445427975ae66c
SHA1 dcde6527290a326e048f9c3a85280d3fa71e1e22
SHA256 b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8
SHA512 92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

MD5 d222b77a61527f2c177b0869e7babc24
SHA1 3f23acb984307a4aeba41ebbb70439c97ad1f268
SHA256 80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747
SHA512 d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 6eb2da39973984369bdb443eef99c657
SHA1 cdb5f6f79137502dcca9e925c79dc81c666402e9
SHA256 4442193def68d499a984ae8565b038b51b98e21f1c17b7d0a8ff9812a4a7b855
SHA512 4840bbc0fe410987d78d0aa802b039ffd1f9f49d514625716ef5b6b029dd7bc771a1be4ca9e2333a100ad4359fa2b79113deac569b35f2eb4190daa2f8aba81f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 4e103402f737e85d054e074acdb239d2
SHA1 9df832978502bf5098d229337ee6f86cf2482b9e
SHA256 69e2b293b29116998368d91a21647eea76fae0ca4d9a7b16b3935a34c40f31cc
SHA512 1d0939eda8ba7f1fbb60cbc627fb34f2fc22207ed88484723635335da94582e1b84644e4f23bfd7b4b29a1c243053ec8320d36a31e0c4f63f6d321990b89b785

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 611c9c069e4fd022838652fc0834db4a
SHA1 4682c2efc9abbbf2f9cca66cdbf9cafbf30fb2cb
SHA256 992557a613c5d5b93a572a57a31aea0abfa26a5bcfceacea906108dd6e04ecdc
SHA512 ea8fbad1d843b46a3b890060841c641756bbce9217caa937f0f53aa90a7bd0b567fba92bd40e9e247f34fbff0cceab9e38a5f3bdfe0810417e8eca6022193629

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a

MD5 a4ee0bb2b60437c50324a4c949c9df34
SHA1 cb56f97901584d963b11319b0a91e7346b7be228
SHA256 d7ef33cb53ade4b69b0af64438c9af094314ff94b8701ec2a5a0868e36fc619c
SHA512 75d6eeb2254b989975dcf005ed43e461ece0c7a75313c2d831c42cbd30ee98c6c9a88cb39ed4affa6b56e0d9b16269a077dc30f3dca0ebc08a7a27d3f0fbc911

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b

MD5 dc11eaa862993c4de0703feda9efc6a2
SHA1 ccba965f67c847067ba25ec25cfd56fd54a02d29
SHA256 272b14ecd9cd8a26aa14d4c18223d15f9c7666e05712195d0dce8a52d6f116d1
SHA512 4e35a82881318f891c9446fcf9980c5bd5c20b3dcdbe4574d1baec11e5ab48f90c145407a48c15c9671797559910b10edf3daebbf8a65f570d8ee34eff42f941

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

MD5 e56beb7a505ab6efa487ce44deb06a4a
SHA1 5c5e2bc095f9d3024ffe9a3d092c7910a82147d6
SHA256 33d4b61f5ec4e537aa23fc69dbbc243aa1f301ac2366634d982aa7cd874c6fa6
SHA512 c9bcd2265b2539c4b51f3a96ddf39165d370e2d100f23330b4b9cdece662d12ef41b500d8aa8205824fb6abeeec9a469073aa229bdcbde6b013056e22b2b1931

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 35e8fab0a5ee8807cebaff38b67e31e5
SHA1 1b0040e62f87ecf366a82215e1be808f1de45cf4
SHA256 04e110ed7949a10b6df3f55d00fcf9e701cd171da73046d1f7dc853728bef4e0
SHA512 a71fa4d07110caa811b1026a47a073c8ab11714259af6c0cc297c64ab06c3c26bbdd31db30ec0eef8ecd4a8b1c3c02348b7dbfd35759acf52e9c180589644c82

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 752546171b372e048cb317c2defb82d6
SHA1 70a29af5e2287c0c358fd30c1d3bc1368bb5c110
SHA256 160f35bb6c1014855d385fb1e94882caab5de45b9efd6e2cbec40a7d40c5fefc
SHA512 4ea053864530ba71a6bab4e38f7000ce5677a52c5d9eb437da136ac2cf6260fef2275ab91af0074878a72bd020aeb55a9a578a88c21aa2a0860021db37692df6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 3bd2dbcd94056d74f5f8d1beadec60b3
SHA1 99b597b9d6bf058b3651ec1645266c24759c1103
SHA256 75acff6f593a3d73d765867286257aadcbac9a2db82add5375e5d6f20cf99814
SHA512 46bc750464abcb19d97515df0dacef11329003c71edf0f4bf70d7efc3f3928606032c8653f01c69aa0252dbbf164914a1e471c4f0cad050ff7cf4f9d39ec7f64

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 0becc3cc7619f0bdb7edf53d05425beb
SHA1 a033693ee466050f37b8c465a1ba3349d8f37c4f
SHA256 e81b4668e238c1ed74b4d8dc182b8f2f8441a92fbf7987116b06debbb32b9958
SHA512 cbc62febc5dbf52710a93650e2b119e3ac7ea495805015f54f402eea6ab6d0008b86654fb4391bc38b416c13787ccb7be291e196fb66d610c4153eb76df9a920

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 8c43febdd107903b78e9cde048fb75db
SHA1 46242e2dc3d1a272c4b068ea19b0999b7e446ead
SHA256 16a73a479cdc4d092d8edc70a467da2fbed554371620b576844724aedd50deb3
SHA512 fa69229006b50f93f8d2d365dc18a0ba3d29253d04c7e501364225fc9fbe70c19e661740c0cfb4c67bbcb6e205576216a6a445af9e3b232b1637f7a094a89b45

C:\Users\Admin\Downloads\NoEscape.exe-Download-main.zip.crdownload

MD5 6da84fd648c8811cc112f4fffe20a24d
SHA1 ba4f8d7fb51ee0a31b068cca51d5e5388c4b081b
SHA256 7b55dfab141eb69abbe47267e396fe8ee6bc4054fc8d4a5d91049b950c7d84aa
SHA512 0ba4c4379b77b465aa13af7ec295a9e7cc1421cff76e735890f46228af2f500202f879468322ad59b6d6ab06710828536ffcddee23093adf82498a365fee6bdb

C:\Users\Admin\Downloads\NoEscape.exe-Download-main.zip:Zone.Identifier

MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 6cf164c8eb231182b782f897c0b2a004
SHA1 82a66e74acb8aa05e0d30e00c1e9b363ddcfec3e
SHA256 6bb1e442d2bf3cb13899f2fc5f8658d47775b4bd288c6fb25ce1b64f9fbf76a3
SHA512 d21314c1cf1e9e26ec8dff6c0e12f2d8cae42df370531d8fab8eb490e6a4cec00dfdd5d0cb15f1c01778066fbab4dfe471799d5aa37867feac747dcc93163718

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 aac2dac7b7420a13dea216cf14649bc3
SHA1 556b282850e2d4ea8b4bb7a9cb8b9f6b0e307846
SHA256 0a0ded08ec3b4f49bc62acc2501931ddc432a0b2bcbf191dcf8dc4182d7caef6
SHA512 6ee7db29ea58d38ca3a344b6bc9b72f49f08b43dcc6a41372fc9f35091c02dc4ebc95ac9367ac77ad81c529dc314cedf83bcfcecb5a985aee03ad14cc870ae9f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 5c58c3cc3cafe01f9ebd4b8fec54ea92
SHA1 a44798f8013c9c9699d860dcbdc2eaedef64536b
SHA256 ff11a921ef351a4d25a27afdebc1a950236065b13a21980db3a0d67663121d07
SHA512 445c460719eb70223031f90773857af5ff49ceed7404da4ba6f425f9b3c819d37e1a543f437ea869d55d90b32a9bf9d6fce929c44412eb38299d6e665790dcb3

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\37db952a-956b-4b56-b2ee-4d8e53149886.down_data

MD5 5683c0028832cae4ef93ca39c8ac5029
SHA1 248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA256 855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
SHA512 aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 1c415cc38bcba4ee0058b1ea889ac4ef
SHA1 cfb818e16d559ad752faa7c58a3d25b5f454888f
SHA256 f14b398a144e413b5fbc919ea31b041e815360f32f884449ea6042fb777b2e01
SHA512 ad503874d87adca9d241ce42f85e5b425709699dbc209a56f4dc6efe3b5a5e675f355548863624f5a521ca05124fc3ad396d3fd36d8e2d2db2b0c0ccbea7d46d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 aed6c1aeb2f715d6515b08a9d7ea491a
SHA1 80267d357a40edac9bdf8a434ab5ec88a32a63e6
SHA256 9390a03924beb1bd95fcbd69e8574e8567feebc22356e65c354c5954c7a38ba3
SHA512 f8fb4a00d1cf044e466233db93a0f2a925f7a4bafdcc9d4697cb65339b1a6c7b5682a0a5405752c17185297674637276a72703f4ff983615c4a6f7637d72c570

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 87b8cd76a3b97af5787f9ab53ef0fd03
SHA1 fc5fbb0ede4b0e6bc9f043626b493a998a346881
SHA256 c072cd25e8eb5eb4ac654f073cb257776f74800d87a816e383d5e36685706952
SHA512 1d8c61bd829ccb1662a50972be414e4d194aceb95b5e4a5ddb9a177654fa58bdecbf589d401b7cab7478488619675c9ecd244e05151b3f3e48533e14d05eec6f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 e3d7c312c36ac997293cea4a8c6a0111
SHA1 5031dca8a670d12b984709ffdcaa41181cb3de21
SHA256 0f5679e868185a178259393133ab58b3ded8d11b4757722c5ba1ca826b758d0e
SHA512 e7eee8f389bfac3c66ec23bcb9f4008fba14c973fe7c75524c6aa1d738e3a2e834f712b20a4522d96aea74b5f7d381b24eb5dbec882a656001a0958cb219eef3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 e78402862b9eb33d85e60a4f07b5d5ed
SHA1 1e3746296c016dea6896fe694b1baf4746260c27
SHA256 06da3655e4d828b611486e89571287b21a70c5a83c09579aa5129eb663cda74f
SHA512 9eea4eb503c775232d40fb6e6e29bc3f6a08bf6318925eb994b654f00a7a115df12edcfd4f9e9958d90dec8789f32f9bf2353d3b0b81a791a220ee18a682580f

memory/3208-725-0x0000000000400000-0x00000000005CC000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 a03a66594d03500f9f348b6630e20f00
SHA1 477704868b02c954d12247db691a3d44e3a4b32d
SHA256 9b529ac2d90bfcc3a1dd1065228f294491f023010ae0ffd8958dc1bc3bdb607f
SHA512 a1cd285226603f8b6e068b657782582f7ea946a01eab5cf7cf626c7595288b01943b4ef344272bd4cf95b6d3ef6cd3ad68174e06382827c4345a0d0fcca1330c

memory/3208-735-0x0000000000400000-0x00000000005CC000-memory.dmp

C:\Users\Public\Desktop\⩷⸑ጹ᫯⢬♒ ޭ⒂ⷵᲱ┓⮡⵶Ṏ܄ⱇ⧪ईԾᾯᇓᔎᬌબՂⵓ⢶

MD5 e49f0a8effa6380b4518a8064f6d240b
SHA1 ba62ffe370e186b7f980922067ac68613521bd51
SHA256 8dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13
SHA512 de6281a43a97702dd749a1b24f4c65bed49a2e2963cabeeb2a309031ab601f5ec488f48059c03ec3001363d085e8d2f0f046501edf19fafe7508d27e596117d4

memory/3208-913-0x0000000000400000-0x00000000005CC000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 c038b8ae21926f2bbfd3d8838e2d924a
SHA1 78fa784a21bc6bf4f5dcb7ebde876d6e688cd155
SHA256 c9f5e468cfe8268dc6d3bae676995865086e6bc1c125e7367398c90ee02a4a02
SHA512 f58c6341f5d79730b6e4804813e76fc2a5eb8fba52243ab5aeafb2e4b2fb8ec75a0e11d95f7d63ba804ac44b5a88b142a23dd75cfac5b7949adf83e0f0dd7c30