hxxps://github[.]com/Sn8ow/NoEscape[.]exe_Virus/releases/download/1[.]0[.]0/NoEscape[.]exe[.]zip

max time kernel
61s
max time network
63s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20251017-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20251017-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
01/11/2025, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://github.com/Sn8ow/NoEscape.exe_Virus/releases/download/1.0.0/NoEscape.exe.zip
Sample251101-3am6csfp3s

Score

10^/10

defense_evasion discovery persistence ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\winnt32.exe"	NoEscape.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NoEscape.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4120983158-4243392658-4150674964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	NoEscape.exe

Loads dropped DLL 1 IoCs

pid	Process
1688	vc_redist.x86.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	NoEscape.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	NoEscape.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4120983158-4243392658-4150674964-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\noescape.png"	NoEscape.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\winnt32.exe	NoEscape.exe
File opened for modification	C:\Windows\winnt32.exe	NoEscape.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoEscape.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134065127399735450"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4120983158-4243392658-4150674964-1000\{675643BD-1478-43AB-BA6E-8030946B987D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4120983158-4243392658-4150674964-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
3992	NoEscape.exe
4552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1796	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 2224	4552	msedge.exe	80
PID 4552 wrote to memory of 2224	4552	msedge.exe	80
PID 4552 wrote to memory of 4400	4552	msedge.exe	81
PID 4552 wrote to memory of 4400	4552	msedge.exe	81
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 3376	4552	msedge.exe	82
PID 4552 wrote to memory of 2872	4552	msedge.exe	83
PID 4552 wrote to memory of 2872	4552	msedge.exe	83
PID 4552 wrote to memory of 2872	4552	msedge.exe	83
PID 4552 wrote to memory of 2872	4552	msedge.exe	83
PID 4552 wrote to memory of 2872	4552	msedge.exe	83
PID 4552 wrote to memory of 2872	4552	msedge.exe	83
PID 4552 wrote to memory of 2872	4552	msedge.exe	83
PID 4552 wrote to memory of 2872	4552	msedge.exe	83
PID 4552 wrote to memory of 2872	4552	msedge.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Sn8ow/NoEscape.exe_Virus/releases/download/1.0.0/NoEscape.exe.zip
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x26c,0x270,0x274,0x268,0x23c,0x7ffde064f208,0x7ffde064f214,0x7ffde064f220
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1832,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2208,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2560,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3488,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3516,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4208,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4260,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3716,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5408,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5576,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5584,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6112,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6140,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6888,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6888,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5532,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5224,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6160,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5456,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7152,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7072,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7376,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7544,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7548,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:8
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4544,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4328,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4524,i,638089754011289371,6457649630189798630,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:564

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:428

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:564

C:\Users\Admin\Downloads\NoEscape.exe\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe
"C:\Users\Admin\Downloads\NoEscape.exe\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1708
- C:\Users\Admin\Downloads\NoEscape.exe\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe
  "C:\Users\Admin\Downloads\NoEscape.exe\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe" -burn.unelevated BurnPipe.{C55BB80C-D81F-42AE-B2E5-E54A293AD9F9} {CC33DFFA-3AE1-47C3-A196-89C729DB5A8C} 1708
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1688

C:\Users\Admin\Downloads\NoEscape.exe\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe
"C:\Users\Admin\Downloads\NoEscape.exe\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:3992

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a31855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 4387fffe30d53483d642a61eedc64f0d7b74a8ed9b252e335a579e083b5745d6
MD5 de9d71b7760178a9a44eaa0466f6e89f
SHA1 326a9d78956a1e7316fa83cd4c207b08f7f3e5a3
SHA512 46c2da2dfa4152c2adfd298f843562e3eba2a38088cb09203a4df55c344f9bf91b955c0f27ce104aa268fa136c98476da20a1e1274279693572f485bd212e44d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P76:fwUQC5VwBIiElEd2K57P76
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a61f005779590cc0356aea5cea883853bd6dec284db163bdc8a6e19d18d5e46f
MD5 07903d092c83ff595fc50a17df11b004
SHA1 474cb57bf0c95e24ef9dbc94cfbf870b06d4c1a5
SHA512 f39c5c2e13d7963a9e7967b3272b25325c4ed1181561d24b0a2737fad64346d581dc11ffce105f325d02bf9abf29e0decc5b71acdb9092ad83054229d469d3ff
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0deab0d16e48d1817b164c3087877cd63cc336cbe09e31ce3920bac64f77b0a8
MD5 92da403a992e45c5d088b0ac0e03c1b2
SHA1 9e0ebc70f1e2017db43810f0ac69ca1e5e5d3c0e
SHA512 63e53f4233cf1168a787127991169fd44d27a4ea6abb39a729b8bac2c6f5db165489a2b4324f395f840563f299fb94619ece380bb2b8127efe63b623ce861cf5
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d6ea13dc60608993f275ca90c4c086f50d93e294ac401406c1743aa91ab33b4
MD5 be5510376b0d827699a4a326abcd8306
SHA1 348814f6be0888a78499c39a44a9ea730e84ba21
SHA512 a466541ae0a2dcdcc595ae1948a346d21e487b5517e88e97571b156bf929e20d1704a3ee57fc7d6ba543fa101d0dc4b8cdd45516b734902c849c7cb77462c5c6
MD5 SHA1 SHA512

Submit Download

5ee9b139-d43f-45c2-9654-c384ec836218.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5ee9b139-d43f-45c2-9654-c384ec836218.tmp
Size 35KB
SHA256 c1c4bb2e5626c7d800ca9917ff14e02e97ab55c437ca6d9aeaca5570b08795c0
MD5 48a1af9dc36f3a932098583c21f71298
SHA1 0a50db601d0bc947a6d816497dd4da881c2e0d85
SHA512 e0f5051ba74dbf9e9591a532f77a50ba502f870ee74eaa9ff3863b8f53854329034f6f050d9195a525a05cb40f6723d7ffcbe7d86284b25a696ff87091e95622
SSDEEP 768:dkFFx+Y7pLuLbWwWFI4YU8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJPnfLl/1go2rov:dkFFx+EEbWwWFI4YUu1jaePnfLFeoNB5
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d5df1ac022474f5c6e1f9d54b9f903bc159412f8a2eca355c040f254053c237c
MD5 41277734d65efabba4494268f6b1caeb
SHA1 5ab2811f31786b9c21f54aaa3ae89f873cfecf40
SHA512 73a9e92203ec0958645bf4601dd95768e0eea599fac0df494c9e9d7b37ac73a65491865d2014d2fc9a8f54d0c95bc9a389e99622ca8416e2170004aacbb15ce2
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe581633.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe581633.TMP
Size 3KB
SHA256 8b61263cc06875aedaa16d01012124f69927bb176a31b0fb885c903e87c07b82
MD5 4a6f55189b6e1936649ebe3587c55af1
SHA1 75467bde093c260bf59167f2db057b49725061bf
SHA512 65ae977eefe0bfd7e7da4a78f5b64608d17ea1fc46147e25c66d9c15d665f96a855ee6a0e8e1800b3dfb0a17e29ac751eb330b6f77f7421799084f74aba5779a
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 0b5b1b7cd1fff8d2609d7953b15ea374dbbb65d59129394e6b11f50283eb538d
MD5 ad38762aa4205d7926a768abfca4187c
SHA1 dcc295d7bea58fc95a1da1b8776d9fb853df4bc2
SHA512 618968b330242669c7fd54800cea199dea7db24ee014c363d03813b528b756937eb3efc3440d4fe2b171a20cac851bd1b1e8c304fec3e9e48fe59d05d87dfb23
SSDEEP 3:MsEllllkEthXllkl2zEklYYu:/M/xT02znYYu
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 69KB
SHA256 b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17
MD5 164a788f50529fc93a6077e50675c617
SHA1 c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48
SHA512 ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4
SSDEEP 1536:hAlMWz7vLDtDSVlXXwpFlorgLUxF+i2IFXaH5EoVDRnaXW:hvuWAUxFhFpoaXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5 SHA1 SHA512 SSDEEP

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 09fd653e03dfe46648cf791dedf70cb423615898895c054b0479171909fa7b1a
MD5 79b25f00c98fd77d4cbdce6e5d01ae38
SHA1 2784aad1cecc4f9b0438c4212d863d3924c35041
SHA512 0d32fe9ec9e9f74bb95ed6e526024984a3a9576482d3628471f5c7250601be11068fb339842d4e7e157d9c1368af31bdf72b3fc030eda1374f19486a09b1a900
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 46e6c6d13144c81d73f9b358e6013ea317d7bab786cce45eeceab52da58b75be
MD5 dd920045415ebdf9ec0d307f4af7b623
SHA1 25dd198bc618f8b4946fac64ae6e5ffe73aeddee
SHA512 f7094b7c073f84deabe2230edc81d5233589e1260ee1d136d323abd9b030f45db7740a6d5b089e87cd4c2ff017b37a846f7b8944df26cf45fc16ef37e00f93de
SSDEEP 192:sVwRgyMh/K1Ml80uwsygWccip7l+DEIZ8p7HY+WNrYjtgm+X6IgMZJ:sVwUwws5Wc/poDs7HSr2ea2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 632b43edee6a9d80ec44e178317bb204b4a16817dd6e9a32377d1fd05140b652
MD5 77775bd5e518761002ce30fd01194efb
SHA1 568445e4fab97a193b0f7948e7ea74e80d903f32
SHA512 cd1d4488ba5f9915663036c34b909c870341ba440398a89493acb3cd802ae09f4803877a436d152c1bb57f5e30bd7f3b605c93ded98902dedf00934dd6539fe2
SSDEEP 192:sVwRgyMh/K1Ml8MuwsyKia7l+DEIZ8p7HY+WNrYjtGm+d6IgdJ:sVwUmwsyaoDs7HSrE8an
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 d10dcdda60047b089849be79c4633aca0df4b7e3b260bb2bd755f28f463f11af
MD5 61c078195ac0a726d07841f0e3a5b92e
SHA1 25cde520e38c37f79073521826199b277748a8cb
SHA512 760b9c5480d2b67116c5ecf0270099b6a19aebb9ff817d58daea654b44a20a69f5b1fa7dbcd17b28fd7a3e9e188bd1a2c8b7f3e0b4497b9e9c2db540ee859dd7
SSDEEP 192:h17pcvrBb/YvyLzZzVxqXQfI3iVOykY8ToX26W4cy3UDCg:jpcvrBb/YvyLzZzVxqXQfAiVOykY8ToA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 04dccfac328704cf57e2dc76b35a73383aa240d5ee58f8c11037e9520fb48e1f
MD5 b983b7c5e6b2686c2b0ab69a5bd2d415
SHA1 c43d0a9a083f04ad56fdea14f38c2cccb300833e
SHA512 b9ab1692e9df9e3aece28eb77acc212e923c502aa0a9f4260dd82b509180df77e5deff11df960715c57166aee3d2f2ef5e66f7d78b25235172524c25fd2610cd
SSDEEP 384:nDfeJzfbqZkSJLdjqiFDwdWqADsNbQXw1+ummfJF9sv1btWolGudznwmcVfjY:rYfJSJLdOuDwLADekoxsvltWWcC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 7KB
SHA256 4fa5052e9e89308c3381cb745fb6dbbd03ab3b6cc78e68cb2623779e5a8befc0
MD5 8ef8e19ef56e982e90412185f6c25cc4
SHA1 045474f2686efd8eef34b3c3ea42764b92bc7a8d
SHA512 e441cc0e431d41724934abff6a0615f0edbc0eb245119d1065d11906ce9419cff2dfbe8150c4f9e5ba1a1c888b5fce976098c8958902d3a829b1a16de21dd795
SSDEEP 192:ZONbyVpbWiRUypa1Cd9svowC9580epRcUG:ZONbyfHq1w9svh8mfcUG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 f1e34e1974cc273ecc2d559a7a49b1e0d5d92abfb642dfae5fd244053107be11
MD5 603c1223a7cf4df744d85ae5e63ab921
SHA1 8c79b614a1cc5d4c10a96ab4d9e6f213821501a4
SHA512 b7f527851dbf7b59222a57d43b24497d45832ea068b42fc4a6f25b2c8351b68466597c93f6cafc0bb06c30e05163dd8055d5022daa3968e8537f7878ac694ef2
SSDEEP 768:QYfJSJLdOuDwLArqkcxsvl36A5SOBdsJdhWWcC:QYfEhOu3qkiA6a4x2C
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9384e8c5ec66ca40f021388e170bfbcdbc68ece6c1cfd7be2c1e0235d19115ea
MD5 e3749967bbbcd35a7ec2d60cb2078b40
SHA1 6d861a83b128d24712d051f9b14d64836db14400
SHA512 aa790b0ee89d5f1f43379b25db8572cb10386a7fa0e539a77af957c945f828ab8a5ad496cc57cd6ab8c7eb709a87930a5298bdc7787408e33cda52a83b9abbbe
SSDEEP 192:ZONbyVpiWiRUypyarCd9sv+bwCxK8IPdUG:ZONbyfenjrw9sv1jtUG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 03bc0dcc70b1bf0f0f9cd229fee31d5b7e8ea18468e98e179210bdf00e2c7d67
MD5 83ce98c24250185422687bdc98719f8a
SHA1 225b403bb240077f604ab4bcfef2ad1520affe67
SHA512 b7d3fd661f8ef337b195113fb28f73ad82d838fd61af8c3e905c5d7cac63744c0613bea9c33a3394d7e9afa884ad1f3a858b1e86bd455189ce73323eb58c3c6c
SSDEEP 384:nEfeJzfbqZkSJLdjqiFDwdWqADsNbQXw1+ummfJF9sv1btWolGudznwmcVfjY:wYfJSJLdOuDwLADekoxsvltWWcC
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 78acf800a76e4f7ee06eff022a2cf18ccd9d60298d836f0fe59df7a902469629
MD5 caf94231d0a654e88362d202e4bb5c5d
SHA1 538d95c11be314b608c59a4119dfbdb951f68269
SHA512 883da2c3ad30db4dc17e9bc918edc68671ee69c8c9d98faf3af2ed0e20fa27082a13c0f38cef3f2e67765b75e596f0a55104532cf5add69bce254c7fe1a17f43
MD5 SHA1 SHA512

Submit Download

a273469f-1160-4012-a7e7-ebef406397a0.tmp

Path C:\Users\Admin\AppData\Local\Temp\a273469f-1160-4012-a7e7-ebef406397a0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba1\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
MD5 SHA1 SHA512

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba1\wixstdba.dll
Size 118KB
SHA256 a9295ad4e909f979e2b6cb2b2495c3d35c8517e689cd64a918c690e17b49078b
MD5 4d20a950a3571d11236482754b4a8e76
SHA1 e68bd784ac143e206d52ecaf54a7e3b8d4d75c9c
SHA512 8b9243d1f9edbcbd6bdaf6874dc69c806bb29e909bd733781fde8ac80ca3fff574d786ca903871d1e856e73fd58403bebb58c9f23083ea7cd749ba3e890af3d2
SSDEEP 1536:nw7WzpopAuJhsVuThs5cXyeM6JUOfPGSpeBxm946ITADDwYkH/1d9chyP7iN6p:pmAuJhAyZFpem90iw//1d9chwG6
MD5 SHA1 SHA512 SSDEEP

Submit Download

NoEscape.exe.zip.crdownload

Path C:\Users\Admin\Downloads\NoEscape.exe.zip.crdownload
Size 13.5MB
SHA256 542c2e1064be8cd8393602f63b793e9d34eb81b1090a3c80623777f17fa25c6c
MD5 660708319a500f1865fa9d2fadfa712d
SHA1 b2ae3aef17095ab26410e0f1792a379a4a2966f8
SHA512 18f10a71dc0af70494554b400bdf09d43e1cb7e93f9c1e7470ee4c76cd46cb4fbf990354bbbd3b89c9b9bda38ad44868e1087fd75a7692ad889b14e7e1a20517
SSDEEP 393216:BATeK1bYlJbM9tAlAkRCnG7H+KlzMNCPm5lvvayDPk15DBJ:BoX16blXonYeKdKCPGayDPiJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ᢅᖑ⮮ᓕ∴⊗Ბଗ⾄ᑓዳᩇ✄⚹ෞᨫ᧗

Path C:\Users\Public\Desktop\ᢅᖑ⮮ᓕ∴⊗Ბଗ⾄ᑓዳᩇ✄⚹ෞᨫ᧗
Size 666B
SHA256 8dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13
MD5 e49f0a8effa6380b4518a8064f6d240b
SHA1 ba62ffe370e186b7f980922067ac68613521bd51
SHA512 de6281a43a97702dd749a1b24f4c65bed49a2e2963cabeeb2a309031ab601f5ec488f48059c03ec3001363d085e8d2f0f046501edf19fafe7508d27e596117d4
MD5 SHA1 SHA512

Submit Download

memory/3992-516-0x0000000000400000-0x00000000005CC000-memory.dmp

Download

memory/3992-633-0x0000000000400000-0x00000000005CC000-memory.dmp

Download

memory/3992-809-0x0000000000400000-0x00000000005CC000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads