664b4b1da036eb36b13a3bce2fd572e37127223cbf6796adde12cbfb3af0d893

Resubmissions

19/07/2026, 09:33

260719-lje3nsgw4m

18/07/2026, 16:18

260718-tr7fwsfv7k

18/07/2026, 16:11

260718-tmx2naft4l10

Analysis

user interaction
yes
max time kernel
312s
max time network
315s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
3D Pipes.scr
Size 596KB
Sample260718-tmx2naft4l
SHA256 664b4b1da036eb36b13a3bce2fd572e37127223cbf6796adde12cbfb3af0d893
MD5 d5b0ed8eca34f8480e555f47269ab0ba
SHA1 39dcb05cabbd45e92b631022a744dd5dbfa4a0cb
SHA512 ea19ec6b93e87494b94cd80ed455f7294dce9d23f79c87d1f5a02a144e9bd8d1accfc8bd1f7162f89b86cb8cba21b7b8b4822cbe5dc563dd35aedb4118a56ec7
SSDEEP 12288:Cl4NXaEeTdbbTxKAWFhBJ8Q0oZyltDqlFGhoZ0joAF:M2aEeTd9KAWFhBJ8Q0aSqlFl00A
TLSH
T108D49C207890C035C8E362B0C65EB63D61BDBE91472646DB1AC837FB9E70BD9563538B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\winnt32.exe"	NoEscape.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NoEscape.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	NoEscape.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
182	1084	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
2268	NoEscape.exe
4400	NoEscape.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NoEscape.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
181	raw.githubusercontent.com
182	raw.githubusercontent.com

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	NoEscape.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	NoEscape.exe

Modifies WinLogon 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "0"	NoEscape.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	NoEscape.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	NoEscape.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\noescape.png"	NoEscape.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\winnt32.exe	NoEscape.exe
File opened for modification	C:\Windows\winnt32.exe	NoEscape.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3D Pipes.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3D Pipes.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoEscape.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoEscape.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3D Pipes.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3D Pipes.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3D Pipes.scr

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1084	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop	NoEscape.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\AutoColorization = "1"	NoEscape.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Mouse	NoEscape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Mouse\SwapMouseButtons = "1"	NoEscape.exe

Modifies data under HKEY_USERS 22 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "0"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288647304168797"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5432	chrome.exe
5432	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe
Token: SeShutdownPrivilege	5284	chrome.exe
Token: SeCreatePagefilePrivilege	5284	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe
5284	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1288	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5284 wrote to memory of 4856	5284	chrome.exe	91
PID 5284 wrote to memory of 4552	5284	chrome.exe	92
PID 5284 wrote to memory of 1084	5284	chrome.exe	93
PID 5284 wrote to memory of 4552	5284	chrome.exe	92
PID 5284 wrote to memory of 1352	5284	chrome.exe	95
PID 5284 wrote to memory of 1352	5284	chrome.exe	95
PID 5284 wrote to memory of 4276	5284	chrome.exe	96
PID 5284 wrote to memory of 4276	5284	chrome.exe	96
PID 5284 wrote to memory of 4400	5284	chrome.exe	97
PID 5284 wrote to memory of 4400	5284	chrome.exe	97
PID 5284 wrote to memory of 4120	5284	chrome.exe	98
PID 5284 wrote to memory of 4120	5284	chrome.exe	98
PID 5284 wrote to memory of 4840	5284	chrome.exe	99
PID 5284 wrote to memory of 4840	5284	chrome.exe	99
PID 5284 wrote to memory of 4588	5284	chrome.exe	100
PID 5284 wrote to memory of 3604	5284	chrome.exe	101
PID 5284 wrote to memory of 4364	5284	chrome.exe	102
PID 5284 wrote to memory of 3604	5284	chrome.exe	101
PID 5284 wrote to memory of 4364	5284	chrome.exe	102
PID 5284 wrote to memory of 2652	5284	chrome.exe	106
PID 5284 wrote to memory of 2652	5284	chrome.exe	106
PID 5284 wrote to memory of 4996	5284	chrome.exe	107
PID 5284 wrote to memory of 4996	5284	chrome.exe	107
PID 5284 wrote to memory of 3772	5284	chrome.exe	108
PID 5284 wrote to memory of 3772	5284	chrome.exe	108
PID 5284 wrote to memory of 1372	5284	chrome.exe	109
PID 5284 wrote to memory of 1372	5284	chrome.exe	109
PID 5284 wrote to memory of 2416	5284	chrome.exe	110
PID 5284 wrote to memory of 2416	5284	chrome.exe	110
PID 5284 wrote to memory of 4620	5284	chrome.exe	111
PID 5284 wrote to memory of 4620	5284	chrome.exe	111
PID 5284 wrote to memory of 2660	5284	chrome.exe	112
PID 5284 wrote to memory of 1784	5284	chrome.exe	113
PID 5284 wrote to memory of 4204	5284	chrome.exe	114
PID 5284 wrote to memory of 4588	5284	chrome.exe	115
PID 5284 wrote to memory of 4588	5284	chrome.exe	115
PID 4912 wrote to memory of 2796	4912	chrome.exe	117
PID 5284 wrote to memory of 1620	5284	chrome.exe	118
PID 5284 wrote to memory of 1620	5284	chrome.exe	118
PID 5284 wrote to memory of 6032	5284	chrome.exe	119
PID 5284 wrote to memory of 6032	5284	chrome.exe	119
PID 5284 wrote to memory of 1676	5284	chrome.exe	120
PID 5284 wrote to memory of 1676	5284	chrome.exe	120
PID 5284 wrote to memory of 5900	5284	chrome.exe	121
PID 5284 wrote to memory of 2700	5284	chrome.exe	122
PID 5284 wrote to memory of 5900	5284	chrome.exe	121
PID 5284 wrote to memory of 2700	5284	chrome.exe	122
PID 5284 wrote to memory of 2404	5284	chrome.exe	123
PID 5284 wrote to memory of 2404	5284	chrome.exe	123
PID 5284 wrote to memory of 3260	5284	chrome.exe	124
PID 5284 wrote to memory of 3260	5284	chrome.exe	124
PID 5284 wrote to memory of 4520	5284	chrome.exe	125
PID 5284 wrote to memory of 4520	5284	chrome.exe	125
PID 5284 wrote to memory of 5612	5284	chrome.exe	126
PID 5284 wrote to memory of 5612	5284	chrome.exe	126
PID 5284 wrote to memory of 4444	5284	chrome.exe	127
PID 5284 wrote to memory of 4444	5284	chrome.exe	127
PID 5284 wrote to memory of 4532	5284	chrome.exe	128
PID 5284 wrote to memory of 4532	5284	chrome.exe	128
PID 5284 wrote to memory of 3604	5284	chrome.exe	129
PID 5284 wrote to memory of 5432	5284	chrome.exe	136
PID 5284 wrote to memory of 2812	5284	chrome.exe	137
PID 5284 wrote to memory of 2812	5284	chrome.exe	137
PID 5284 wrote to memory of 4524	5284	chrome.exe	138

System policy modification 1 TTPs 5 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NoEscape.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	NoEscape.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	NoEscape.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoEscape.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\UseDefaultTile = "1"	NoEscape.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\3D Pipes.scr
"C:\Users\Admin\AppData\Local\Temp\3D Pipes.scr" /S
1⤵
- System Location Discovery: System Language Discovery
PID:5316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff25d9c728,0x7fff25d9c734,0x7fff25d9c740
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,10706002165530356425,15175105655990138250,262144 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1952,i,488024344571905420,1070650135917541714,524288 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,11223229783137611035,3052103227102073952,524288 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:13
  2⤵
  PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,15195346224362140220,6369925414229802336,2097152 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,14834042342160275439,10620049671897636674,2097152 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4664,i,4714512241577732208,9597357107859262155,2097152 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4896,i,11885772127507701974,14136233649638781177,524288 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,1953542248603718458,363112560603720188,524288 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5512,i,811057669108074800,3789825224219162679,2097152 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5552,i,11519919102694619810,14452517593731215215,2097152 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5540,i,6335799608515336826,12520742788287674345,2097152 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6032,i,11402818972985902686,3392247285425869151,2097152 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6056,i,16715379831594246216,3655594687185853862,2097152 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5592,i,6633806310535678580,18152282097723490721,2097152 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5604,i,14161342669062820736,16714497873244537858,2097152 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6112,i,7354289005623145787,17658605370703647177,2097152 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6036,i,9217625558417081802,11678425780620224685,524288 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,3760894368191491269,12477424162219310084,524288 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,16515144043902933012,13962056873144301630,524288 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5444,i,1981248525010179147,17269087972603340392,2097152 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6128,i,11086658878122678505,11901779438081994850,524288 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:14
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4756,i,5533702957921662581,12779035637107861324,524288 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:6032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4500,i,17860707514926696685,15176798555953838110,524288 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4796,i,14387489589958163932,5270789707464175171,2097152 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5708,i,15484747633624286559,5107656125600150952,2097152 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:9
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6068,i,6630326369705780923,13273204234538399730,2097152 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6364,i,15184287703304107587,6144255651968196939,2097152 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6108,i,14849667059381735821,14098624507937550153,2097152 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6400,i,1993357970527056781,13549713585214125765,2097152 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6636,i,9394076670096411949,17980933169576864434,2097152 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6896,i,10718955087380711911,10343576354992022850,2097152 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7300,i,18067627905510601622,3774133527641561572,524288 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:14
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4752,i,13419014117153393295,4237428291566717196,262144 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4496,i,16224499547249873736,3520048686336090632,524288 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:14
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=7660,i,1257137901687382227,9733784402586131174,2097152 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=7564 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=3696,i,14714562048626373545,13474203508247261204,2097152 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7812,i,916023145358170467,8283025700589059410,524288 --field-trial-handle=1880,i,18293200404422322649,8567527310322909089,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:14
  2⤵
  PID:2468
- C:\Users\Admin\Downloads\NoEscape.exe
  "C:\Users\Admin\Downloads\NoEscape.exe"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops desktop.ini file(s)
  - Modifies WinLogon
  - Sets desktop wallpaper using registry
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - System policy modification
  PID:2268
- C:\Users\Admin\Downloads\NoEscape.exe
  "C:\Users\Admin\Downloads\NoEscape.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4400

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff25d9c728,0x7fff25d9c734,0x7fff25d9c740
  2⤵
  PID:2796

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3112

C:\Users\Admin\Downloads\3D_Pipes\3D Pipes.scr
"C:\Users\Admin\Downloads\3D_Pipes\3D Pipes.scr" /S
1⤵
- System Location Discovery: System Language Discovery
PID:200

C:\Users\Admin\Downloads\3D_Pipes\3D Pipes.scr
"C:\Users\Admin\Downloads\3D_Pipes\3D Pipes.scr" /S
1⤵
- System Location Discovery: System Language Discovery
PID:1144

C:\Users\Admin\Downloads\3D_Pipes\3D Pipes.scr
"C:\Users\Admin\Downloads\3D_Pipes\3D Pipes.scr" /S
1⤵
- System Location Discovery: System Language Discovery
PID:3112

C:\Users\Admin\Downloads\3D_Pipes\3D Pipes.scr
"C:\Users\Admin\Downloads\3D_Pipes\3D Pipes.scr" /S
1⤵
- System Location Discovery: System Language Discovery
PID:6092

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39c4055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:3276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 b3640a0fbf727ccded0f13bf4bcf638b7a59787e97d9362d58aa539c96c2744e
MD5 90bda241bdd991a97d7632319488b19a
SHA1 761d8712c3d94e88c0463a0514d66aeb5f098cc2
SHA512 07f28b8ae4d46f7ae6898c4ed39fa8771b56057e38afcaa6afadbf9151891727d4c6e39afab833a7d9ea0a1c430082f7197a753a6c455327000441403ca50d2a
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 373KB
SHA256 00dcd72487112e44ba2487e5eb363a98d65f14344edef5293c8e9dd52850ee58
MD5 ad6388a08d35f6d67db1213404b7f81d
SHA1 55cb415cfa760fb4beda8422d7c635cd4caf1915
SHA512 1b92070f13725fbe34b18dce86e09ee76536ef7dd7190f2c11d54f71b91acdfd40f03c8972a85099b988fae24eaec038be967cbe7b57783340140481b9362248
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8E9:C8tg599lGDBskZP58B67znOwGQ8E9
TLSH
T1A084232C983F6900BB0252741FD6C76E4FF40988A2C0D4C28254A193F9B7EA7F5A7779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 eab0d1d901d5a073a90f099e847af90d77a65e1fcdecca441ed1937a721ce6ed
MD5 b11d75511b023dab95288defb16e7cb1
SHA1 bc3c10fce5a4281de09215cc42ff4e1344870404
SHA512 bb9ab73b6dcb8aa685d513b55c3b267369ed40d7dbf83586c0d397e202c4fb43217792fb53dc409aab545e1c74f1ea09b6b976627bed886a71c72b44a18d87ff
TLSH
T166411D358BDEEC5FEF70753388BD2DA1BA1C389E0D4987879012A4583F4F2E11956038
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 15758c526c8817033aa8f72632fe03a052f29d2c261b7fbefa5a36fdee0f76a3
MD5 885bd54f0a8bd17453acb5648983d4d6
SHA1 56a80b9237e73abac8c1951aadc68da7389f58a5
SHA512 4ff5f851524d60ceef403c96f6c4be9a2de4f9ab93dd59ef5cd92d4b54651606f690e956d6d827fc07461abdb8c3db9507b8047ef19c0d48304d5659cc16be3d
SSDEEP 96:6obTwT2ZqhusmJI+2fCZtfuEMScDfma6JgPz4ser8b8t6D6qOTqz2SqhVCoMIToI:6C1J9G1zDi0mTtz9ZOGJ3OxWK967
TLSH
T1D4A1E92176DFBC5AEFA8A431C4FE3CD0B93E28BE5D4B4E8A501462386E5E3E055D1078
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 dd8a6bb31c7983bb4a8edef8f3718275d447784a53107bfea04925db2dd39e73
MD5 99c15b8476733100816f202feae73f20
SHA1 edc27ef4c4fe8806b0dbfec537591c321b28c46a
SHA512 184efdd27c798cb957496bd2bc2799e06976435c8d94d48e77cc4953ac83941ade2be0a06367539fde4fdf4c9f5c4488c77736f744e2a1776679867db9611483
TLSH
T1DBD012515DEF3C47DB5445B69C702CD47C1C09071F05595380D0A04C9E515A75B85072
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 6978bead9c943732d1f229dbc2b0e5b348564fdc4791bf5d3a3e124bdae0158c
MD5 4194c2631cd69c44e3aa678927fc6c77
SHA1 2991cb6384eec52edb0995f96016f26523211ddb
SHA512 555f76aa1e09f871a36b97fae539817c306eda9936a44ea41bb02ae002d79a899aabc7214611c9d97c4e1433340d71bea3ca3a6c74b27e97c862040dbb534f73
SSDEEP 384:DgnaBZZ9Y56JSzzSpeDql+BG6Be4PJkJhL/LK/bmGo9hoggThDIgNSalDf5Fdmte:x69yFoB9VXqCYk
TLSH
T1BF928BF3C3E4C22D895669F1AA657E1BCE6D0B24421C3C57CDD8BE0B93E2472D241A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 7801adaf54ba64e57c30a6e36fa9b406053cee5f067e89be2b443a89cf982a35
MD5 ff37ec2771b38b946a46b9a934e083e7
SHA1 55d21fdcb99e554b029ea8287afa497ae22f48ad
SHA512 a357e6a02574bb91647c38dc63ec57701cd2ae94e9a3db941ea73369d99a1c34ac02ea41553081e5b20bdf84a247e32729e0ebc7d71a89122e9fa7c84036b5af
SSDEEP 48:YALlqdqsqrh/hmsJhWXLsJhWfoKssRsl+sgIys/18Fs1qsxfsnosWKs/4sWfjhhw:DgnaBSL/ueIv/bmG5Wfjhq
TLSH
T182815AF3C3D4C66DC81166F49B216E1ADE290A28122D3C2688D8AF5F57F2972D21178E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 3KB
SHA256 caaae698d6d04bc8af1b28eb03cc95e80645ceaee2d14d0cd39a01bc892ea9d2
MD5 604984a68c4154baaca7e1b13865228c
SHA1 bb9cef984e56edde288ac3214ef55f0c71f1654c
SHA512 c26ff4306e65b656100f5bbfb91519256ecd610800f3b0557eab52aa9da0e1054616f6e1816dd1599676edaaa0b1f95021a3325ef39fe491ba625f1520615ceb
TLSH
T17471FF97827F741B247D9A7B2D44B84D6A7EB8320251A8F4CE5BD36DF0868F71A12423
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 34fdaf334889b5fe311bea6cbd663b87afa6d58e6e5ca8903eb25a576609a43f
MD5 c18b1bb8c1ddb1e3cb330ec41934f138
SHA1 f7163181aca427ac17955ed3e69848bd7061bc61
SHA512 00b28163fddc00a6874ba1a97918058d7d4c2a440896eac1fc6d4c99e1b2a989c272dc5428d0fa7397ecba0f3d4d2d0fd0e5c52a4848fc4001f3315c07de6ef0
SSDEEP 192:rR9cBzy7dGv7efPRpzGybYLRy98Hsb+WN8TLxZdaGYIh2iNWDkwIkVyIsnAUgE:rR9mzypy6Xh8NyuwwdLaTG2PogE
TLSH
T10A52C65BB9147D7B6DCAC22AF9217792E7F5202271E02E84E7FC8A5C14E79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 eee64a8cd330819007f3942ab5e0a15c59c53cedb060cbdf238addefc2ffc3d8
MD5 d9c9d37256560c5346946bfd41f28411
SHA1 bd51d7166ed1c9bd285ae3742bd30be4b814c299
SHA512 729b77b2f1a197bde7f8c5e6fd3e0a695d6f11ef14a93369ed08e9c9c935bb0769fdfaa5955582a36f0e4a8ecf52a0e2b995e39d4d5c375f209c1fbf14cc884e
SSDEEP 192:rROECdGv7eAPRp2l98Hsb+WNnRu/3xNWDkwCkVyIsnAUgE:rROE6yDXauwsfGigE
TLSH
T1CD32B72EBA14797B6CCAD21AF9217793E7F5102271E42E84E7FC8A5C15E79CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 5e3c970c43791d1187e59c106012fcfa75ef43b8edf2c8aa112c882e9ea50326
MD5 0e36967f6673c9dae13f56560e0b4410
SHA1 d9880962b57df2641a3617c83fd7e84b9c4b8f4f
SHA512 889feac890f5db38bc7bede8d91dab6d197ca4972ef0d9d5184ddba82b228cbc451629ecb05546753493094a870c701c04a8198835385040d37c98702b710fa0
SSDEEP 192:aRRECDGv7dAPRp2l98Hsb+WNnA50pNWDkw3kVyIsnAUge:aRRECysXauwo0OXge
TLSH
T1E232A71EBA54797B6CCAC22AF9217793E7F5102171E42E84E7FC8A5C14E79CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 09ed86a5581543c3d077d5aab8a957934df42dbeb06032ba52c1d0cfe3136db9
MD5 5989ad3a608cbea528f9fe1e04e77f5e
SHA1 9b0fc70a0fefdc53ec89a409fa7da198ff84dd75
SHA512 eee392145737dad5eca33ba114689bf6e98ce6c9fc624255c836a7f677939a5d371aacd0c9e1bb4ab4ae66e1956bbddd1e1c5a6d90074e638996c094597d36ea
SSDEEP 192:rR9cBzf772v7efPRpzaVxUiRy98Hsb+WNjH0j7RO+9qWoNWDkwI9VyIsnAUgE:rR9mzffC6X4yuwEMtWVoLE
TLSH
T13A52C76BBE1479BB6DCAC229F9217796E7F4102261D02E84E7FC8B1C14E7ACC6217447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4c407e0e698fb6c4b20cde3d6678126888c5a4efbaabc706c29d751e7ac76a87
MD5 8641c23ec4de81067c894d7f9028a5b7
SHA1 0ebc804a9932e84fe02774f6a5c0e0616e0be360
SHA512 d972663b73e79ea476787c44cfb5249e1da4a1d8bc6260d78d31abd3ca6f8e4b4031e5d1047aabab26831d0f3f99d3e686760d06a127b07fb335e476e47a8e2d
SSDEEP 192:rRNcBzy756v7efPRpzGybYLRy98Hsb+WN8TLjwoYIh2oNWDkwIkVyIsnAUgE:rRNmzylW6Xh8Nyuww4lG2VogE
TLSH
T15152D75FB914797B6CDBD22AF9217792E3F4102262E02E84E7FC8A5C14E79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4693d16233e2b4ac76aa99fc0b79cb50b9870e5ece547a1984a0b7b05898e326
MD5 7bb04335701f9d7c31c53fdb971748d0
SHA1 54cfff2ab6a52cc484f1d793e6b4fb8dc1aa7935
SHA512 5db8966a9f626309a559f07c5d4ca7c6e72c2e5bf2e1711796a22582074c63a60ace557715a3d65de336edc13ce3867ca3f9cc540d2d787be2da4e483d45eb0e
SSDEEP 192:rRNcBzy77Yv7efPRpzaVxUiRy98Hsb+WNjH0jM9qWuNWDkwIkVyIsnAUgE:rRNmzyfE6X4yuwE7WTogE
TLSH
T14F52C85BBA1479BB6DCBC229F9227796E7F4102161E02E84E7FC8B1C14E7ACC6217447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 998fc2fd7850714ee166d001d6212ef3c35e7f67bf70d3e9db8f2ec3de6ae705
MD5 e2c4b131c7a94ca0c3e4d5e06621f451
SHA1 81c60164dfc7faa9b30300a40d423fa7f122b4d4
SHA512 c4dc29498049913ca81743f13836a9cfb3fc64f2f05d2b19409669fd1677f65fc8bcf06e3fc5e41705548a9fc7f72fdd6dc993924bc69dc8c29516f000705230
SSDEEP 192:rR2cBzE7dGv7efPRpzGybYy98Hsb+WNnxZdaGYIh2iNWDkwIkVyIsnAUgE:rR2mzEpy6Xh8yuwxLaTG2PogE
TLSH
T1BF42C65FB914797B6DCAC22AF9227792E7F4102271E42E84E7FC8A5C14E79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d876e8c534adec7299fb1ed97d0ea42cc3b7962befe429a7192a3480c563f80b
MD5 6b95f95e92b5d1d0183fc90d6b1985bf
SHA1 8aaba8cef144443587dd77b1d74fab32411210ce
SHA512 a5344d496ecda0aea87814e49bd20d1ab4a213fb508cec49c5837376ed01bece43651bb5d3079b82dd3fd4c836d061b6bc7aa070a456f9535534a114148e2a7d
SSDEEP 192:rRNcBzy772v7efPRpzaVxUiRy98Hsb+WNjH0j7aJ+9qWfNWDkwIkVyIsnAUgE:rRNmzyfC6X4yuwE8tWkogE
TLSH
T18452C86BBA1479BB6DCBC229F9227796E7F4102161D02E84E7FC8B1C14E7ACC6217447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 60f11acedf516e3f4bc4ce10c53511d8925551cebd01304a64e99a935f307f89
MD5 a455b45711640bf4d68628b44d297f63
SHA1 29d995601b1d664932873ad57b7ec3233e250fb3
SHA512 fcc050fdffea358027870a2adb55c132f8ad7345679130f8b398ef2acd7e13415dd2a9ec46fe2e9671153ac3dbf4947cb3b1ce9629f824c99aad1a3591a904cb
SSDEEP 192:rROE7dGv7efPRpzl98Hsb+WNnxZdauO7NWDkwIkVyIsnAUgE:rROEpy6XZuwxLauOoogE
TLSH
T19942B72EB914797B6DCAD21AF9217B93E7F5102271E02E84E7FC8A5C15E79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 bacc3ff2c7175db0f4dfdb3e34fb73bc71d402c99534ffdcf8cf6c1bf9e719ce
MD5 dc36f1f18c87aa0549f328f380bfe9b2
SHA1 bf07ddecff9556c606c4a954e09ad38a65ca7541
SHA512 6388a1d719cb929e068d4cd47ba1a712975f6f7f26827937ac922db60b79358068bc1d29a57edc1d91b455ba97d67ea60637c19a1118fe07271a762bad4d521a
SSDEEP 192:aRRECDGv7eAPRp2l98Hsb+WNnclhyNWDkwCkVyIsnAUgE:aRRECyDXauw0hfigE
TLSH
T1BA32B72EBA14797B6CCAD22AF9217793E7F5102271E42E84E7FC8A5C15E79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 48cbcc88875a7e40f96f5d34c4b47658bad92859246ba43e3509fc84d9a873d6
MD5 3f09074df2208ff0b0fb67eb67589e3d
SHA1 f444901a792b995ca0e4dc3f3e77449b6b15f7f4
SHA512 b4b506ccc7962e7b505271459f0c8ee556d2d7f0743cfe7d1462e6df75110546d1d9288138a978d17f1ab763803edd941d6e39ebcca28b5ca8491f950b297943
SSDEEP 192:e5a4K6R97KxkXqK4I40pUZNCgVLHrKHfFKslE8/1XzKD/ed+ErUkKNdrtumtK7rx:Majm97KxkXqKf/pUZNCgVLH2HfgslN1N
TLSH
T12E32D827A48D9E7F0FD8D518CC136F8B6CF5429262780D2896FB9D0803A578E114A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 2dcfc46ba0237db4b046901e3c25319b411aac6865dc60632c87524fa7b93a9d
MD5 ee74f680878a9c7ec096a71eb1e615d9
SHA1 892a3d872584b684a36e4f5e56e90f0f4ced1935
SHA512 ee6136353cfcd83c23e35a24d1c58e69555f3c0e0665894c6abeae95c47f450481c2b79b100168ad28fea6e4a3e70943a33719c57ced590583c79954878b1abc
TLSH
T1D9B0023500508D53D5060B75A3EA05D7F7698C7753838267C6E212B8D416A9AA7B5B81
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 9a96000989c336016ec6d5e0ed87e67c12d68cff04bcd0dec8a156dc7fa6bf40
MD5 540f9047f81c189fe94695abe8d7b319
SHA1 7a6285e71fd006293d57ee3adc5cc1ef4e457757
SHA512 41cf43d01ee29920c1acb51d0793fbf4c3cc4dafcf4f92fbe0d57b31022b47b28039c76199d4ea38da2ebc6b4d36d10ac9b710a35fefe34a3308d019db9481e8
TLSH
T1EEA0021251C01C16ED14A3B0B5F5599133694C551955871794A20A44886BDD46915A24
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 781bfa1c3fdaae7dc19b83fae4a9d66b3a9021dc64e1dfaa53dca9a9c8462009
MD5 39dae2e9015c317bc4eec044c050536e
SHA1 d777a55c6bcba3ddff16f68128c226c0485e4f2b
SHA512 855f91118712fca7aba1baf775391faedff463d36966b71376e1c91eb80da012404c45d606aaadc271b85466a892a832f0cbc71a4a15ac9a92679aa25f7292ca
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5dbba2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5dbba2.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

aa661a96-999a-40fe-83d2-5b820db34cbe.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\aa661a96-999a-40fe-83d2-5b820db34cbe.tmp
Size 13KB
SHA256 34bf91e1e83e8068e6957254b6e8ce3e5d68b2591336fe0f581ff80ac23e8f62
MD5 a4f99a7496b664d2e49bdb0f5f6d90dd
SHA1 ff0e5a7dc5fcdf7eb6d231df0e5f5bdd37a46831
SHA512 4948cafabf548eee5098c399a5f9ef00e4dc6c3a817abb18ecea6489b5c8dd6e4a288da2e18edfdcf99499ab85e618c75a179a9c2dc70f9549923d441e08af3c
SSDEEP 192:rRNcBzf772v7efPRpzaVxUiRy98Hsb+WNjH0j7RO+9qWKNWDkwIkVyIsnAUgE:rRNmzffC6X4yuwEMtWnogE
TLSH
T19952C86BBA1479BB6DCBC229F9217796E7F4102161D02E84E7FC8B1C14E7ACC6217447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 e02eb8bb2087c439d3e1e6e7f67dc8a78600496030301acf7ab98b434034f59e
MD5 f825b047de00af0033ec5ed1a10cf51c
SHA1 e81a105ca9b1d7fca99d7d0ba90f4ba144703197
SHA512 85d06b7e7119fab01992983b5136ec8abb73fd36918040de418a5a3663cd6c1b68425da279fcde84f203730077984b21c71ec5f6f166f5bdbc275ed7f843c23b
SSDEEP 3072:ErikqjRlER6EZVzdb3qfjOa7ZuzhCxKWsxQpeBf2L+:gik4RlER6EtbaSgZoh0KepeBf2L+
TLSH
T136C312B1E03E79497E3A548AB14ABB9BCC14F1F7FE9E74CD86306B06A171AD5014085B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 4847dc27ed0a593d823b606ca0630292961b05bec239a1b5a941131e18f32a4c
MD5 9ecc4309a8089fc3adaedd69ec07d917
SHA1 fa5ba3292fcd7959fe3646686158298e398c6a22
SHA512 3d523a063a37cd3c578ef71b34240851cb561cebf1f42bdd33a3b0f5b10fd7140470e61f02488faf67f5cae560295be8c6935ce9c0381d9300ca04b9ebe31f63
SSDEEP 3072:frikqjRlER6EZVzdb3qfjOa7ZuzhCxKWsxQpeBf2L+:jik4RlER6EtbaSgZoh0KepeBf2L+
TLSH
T16EC322B4E03EBD05793E819EB14BB79FD924F1B2FAEE64CE87346606A1B1AD5011041B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 5f06fe2f32c11bed840eee34bbb65f19f8627569ce3ef4a8aebf0304d929f53e
MD5 cb324182a1928b2967e8cb6ff32e9d43
SHA1 6aa588b3f26cd4deef015822985990c95800f9d4
SHA512 9f20fe26691b296ac386e197666ae30986223b337c9e95896126201d2e369a6dfcb4c15d510e65261c99f300bf9be1f2cffd19b40dbe119433283df9d6960906
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5HHDvB6eGyvkonyob1v4a:MC0HJm5FHuPgXDUDDZW8nyobZ
TLSH
T1DFA12AB1A4A94CB759B7D645F9832A83DEA4A22769A0AF80DADD1F0C01F31D81341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 95c16bac1a4ea24f9b53bbc629616f7647b6dcea11826efdda61d4fc400bc32d
MD5 f1c7da20a9b518ffd9592f21c67228e6
SHA1 e8f36026a14d72cb345d6eaad6d096140c6e76ee
SHA512 566410fc6c59b4189c0f31affdff7e8c77f761d3dfaf8aa5f6582b01d7384fea7c5aa8a0f47a813a4549af670328ab9d4fd15f29003e1f53022fbc349f6904e2
SSDEEP 3072:jrikqjRlER6EZVzdb3qfjOa7ZuzhCxKWsxQpeBf2L+:/ik4RlER6EtbaSgZoh0KepeBf2L+
TLSH
T1AEC322B4E03EB905793E819EB14BB79FD924F1B2FAEE64CE87346606A1B1AD5011041B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 4c297a95fa88029585c24df60262cee1f9fbfae8134ce79b8048fb571539c858
MD5 bc2623ee0c738db395f04c8f023fe276
SHA1 3dac73d4c7885f93c09f3aa0fd9f63b6997c38c6
SHA512 4d6b9501fa9683e0af19c350d24eb47025ca56280dbafe74c61eeb70844aaed46c7c76ee35699e164384cf2ab971bf3ffe9d76753bcb03c0a2ef2d7b70781619
SSDEEP 3072:UrikqjRlER6EZVzdb3qfjOa7ZuzhCxKWsxQpeBf2L+:wik4RlER6EtbaSgZoh0KepeBf2L+
TLSH
T115C312B1E03EB9497E3A548AB14ABB9BCC14F1F3FEDE74CD86306B06A171AD5010085B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 1ce832b4a3ac6f54bf6b8f6a21d9534f2fa62c70bb3c1b8d2fcd053c66661db3
MD5 ad0f4549c68e471a7275c351137eacba
SHA1 5c531888764171a1667a5c6fd2e2e7d3ba9d745e
SHA512 dd0e096a6b219fdbda7a26730d24486460d82cad3f815a58e552b06f8572ac24f3b372d20b8e382f5fae7543a2596eeef3ce2f8804753ea3e6813e9cfef65366
SSDEEP 3072:4rikqjRlER6EZVzdb3qfjOa7ZuzhCxKWsxQpeBf2L+:8ik4RlER6EtbaSgZoh0KepeBf2L+
TLSH
T1E2C312B4E03EBD05793E819EB18BB79FD924F1B2FAEE64CE87346606A1B19D1011041B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5284_225682520\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

3D_Pipes.zip.crdownload

Path C:\Users\Admin\Downloads\3D_Pipes.zip.crdownload
Size 251KB
SHA256 4ffcc9bd9ef9bcba990caec3463e2e4a1d4515d9e72f8745aea592e0fa26fa6b
MD5 5e59b9a2743207456611c2581d5e1cf3
SHA1 0416b822072370152d3239ef1c13dff578ae33d6
SHA512 72d15fa49cb6fa5a1052844fb0757150b4545171a4fce432ab38a6c715a1fe63dc49afa754e2ccdfc728bd87ead52ca2726a33e5a18f2b99d3664b0dac640060
SSDEEP 6144:s+SLjbOr24L+QiPnm49npNpDbnNY32LnH/sLdf3ywA6Dv5G:syKPm49n93nZgR3yxyxG
TLSH
T1A0442382FE5F66ED24002C1B37926B1E12DC2E40E272AD83BFDF4418A54565E7CE7E91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NoEscape.exe

Path C:\Users\Admin\Downloads\NoEscape.exe
Size 666KB
SHA256 d30d7676a3b4c91b77d403f81748ebf6b8824749db5f860e114a8a204bca5b8f
MD5 989ae3d195203b323aa2b3adf04e9833
SHA1 31a45521bc672abcf64e50284ca5d4e6b3687dc8
SHA512 e9d4e6295869f3a456c7ea2850c246d0c22afa65c2dd5161744ee5b3e29e44d9a2d758335f98001cdb348eaa51a71cd441b4ddc12c8d72509388657126e69305
SSDEEP 12288:85J5X487qJUtcWfkVJ6g5s/cD01oKHQyis2AePsr8nP712TB:s487pcZEgwcDpg1L2tbPR2t
TLSH
T174E4230297780DB8E2B619755070A50FE8F4FE1A30781D1A84EC77A139F9689733B6DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

෠ᮢタ⭕ఁߛᮙࣘಒ᐀➕⇂ዷ῱ᬿ⪪௤ៗནⰤࢨᥡԱ₪Ჳᑥᨷࠧ᠒ᖎᮦ਍

Path C:\Users\Public\Desktop\෠ᮢタ⭕ఁߛᮙࣘಒ᐀➕⇂ዷ῱ᬿ⪪௤ៗནⰤࢨᥡԱ₪Ჳᑥᨷࠧ᠒ᖎᮦ਍
Size 666B
SHA256 8dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13
MD5 e49f0a8effa6380b4518a8064f6d240b
SHA1 ba62ffe370e186b7f980922067ac68613521bd51
SHA512 de6281a43a97702dd749a1b24f4c65bed49a2e2963cabeeb2a309031ab601f5ec488f48059c03ec3001363d085e8d2f0f046501edf19fafe7508d27e596117d4
TLSH
T11D010292F2C309682B19FE75C76CCFBD4B5A12A58AB7D19F0D84034344C0611599D76E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2268-1224-0x0000000000400000-0x00000000005CC000-memory.dmp

Download

memory/2268-1587-0x0000000000400000-0x00000000005CC000-memory.dmp

Download

memory/2268-1211-0x0000000000400000-0x00000000005CC000-memory.dmp

Download

memory/4400-1215-0x0000000000400000-0x00000000005CC000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads