hxxp://getsolara[.]dev

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 23:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://getsolara.dev

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
4436	vc_redist.x86.exe
4456	vc_redist.x86.exe
4668	vc_redist.x86.exe
1672	vc_redist.x86.exe
3724	vc_redist.x86.exe
4460	vc_redist.x86.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoEscape.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoEscape.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1032	notepad.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2704	taskmgr.exe
Token: SeSystemProfilePrivilege	2704	taskmgr.exe
Token: SeCreateGlobalPrivilege	2704	taskmgr.exe
Token: 33	2704	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2704	taskmgr.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe

Suspicious use of SendNotifyMessage 35 IoCs

pid	Process
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe
2704	taskmgr.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 4436	2152	vc_redist.x86.exe	127
PID 2152 wrote to memory of 4436	2152	vc_redist.x86.exe	127
PID 2152 wrote to memory of 4436	2152	vc_redist.x86.exe	127
PID 3924 wrote to memory of 4456	3924	vc_redist.x86.exe	132
PID 3924 wrote to memory of 4456	3924	vc_redist.x86.exe	132
PID 3924 wrote to memory of 4456	3924	vc_redist.x86.exe	132
PID 3528 wrote to memory of 4668	3528	vc_redist.x86.exe	135
PID 3528 wrote to memory of 4668	3528	vc_redist.x86.exe	135
PID 3528 wrote to memory of 4668	3528	vc_redist.x86.exe	135
PID 1620 wrote to memory of 1672	1620	vc_redist.x86.exe	137
PID 1620 wrote to memory of 1672	1620	vc_redist.x86.exe	137
PID 1620 wrote to memory of 1672	1620	vc_redist.x86.exe	137
PID 3968 wrote to memory of 4460	3968	vc_redist.x86.exe	139
PID 3968 wrote to memory of 4460	3968	vc_redist.x86.exe	139
PID 3968 wrote to memory of 4460	3968	vc_redist.x86.exe	139
PID 1920 wrote to memory of 3724	1920	vc_redist.x86.exe	141
PID 1920 wrote to memory of 3724	1920	vc_redist.x86.exe	141
PID 1920 wrote to memory of 3724	1920	vc_redist.x86.exe	141
PID 4460 wrote to memory of 1032	4460	vc_redist.x86.exe	142
PID 4460 wrote to memory of 1032	4460	vc_redist.x86.exe	142
PID 4460 wrote to memory of 1032	4460	vc_redist.x86.exe	142

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://getsolara.dev
1⤵
PID:768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=5036,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
1⤵
PID:1944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=4428,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:1
1⤵
PID:1540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=4944,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
1⤵
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5588,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
1⤵
PID:4120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5612,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
1⤵
PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=6036,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
1⤵
PID:3804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=5188,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
1⤵
PID:4208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --field-trial-handle=5636,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:1
1⤵
PID:4020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --field-trial-handle=5192,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
1⤵
PID:2712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5376,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
1⤵
PID:1300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6116,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
1⤵
PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --field-trial-handle=6760,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
1⤵
PID:3836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --field-trial-handle=5548,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
1⤵
PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --field-trial-handle=5504,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
1⤵
PID:1992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --field-trial-handle=7024,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:1
1⤵
PID:2820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --field-trial-handle=7208,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:1
1⤵
PID:1564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --field-trial-handle=6776,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:8
1⤵
PID:2388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --field-trial-handle=7644,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=7660 /prefetch:1
1⤵
PID:1660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --field-trial-handle=7192,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:1
1⤵
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=8124,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=8120 /prefetch:8
1⤵
PID:4084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=6788,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
1⤵
PID:2216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=6216,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=8292 /prefetch:8
1⤵
PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=8280,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:8
1⤵
PID:2512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=8592,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
1⤵
PID:4848

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=8640,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=7940 /prefetch:8
1⤵
PID:216

C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe
"C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe
  "C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe" -burn.unelevated BurnPipe.{E8B21775-D76B-4CD1-BC2C-88D6AB486A62} {12483333-5C60-4948-9F62-562527434984} 2152
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4436

C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe
"C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1580

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2704

C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe
"C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2152

C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe
"C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe
  "C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe" -burn.unelevated BurnPipe.{D833EF1F-3EC3-407D-A2FB-405B9AB7FC9D} {7A08EA65-7B50-4DA9-8FFC-CF7725BEFF20} 3924
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4456

C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe
"C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe" "C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe
  "C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe" "C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe" -burn.unelevated BurnPipe.{46F94978-E1AC-4F2F-888E-A4A5765760C3} {E0502234-2D01-40A8-B455-5D268853B78E} 3528
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4668

C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe
"C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe" "C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe
  "C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe" "C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe" -burn.unelevated BurnPipe.{0F2F56A7-2D4B-4CB4-96BA-047456ED679A} {EBEF1BF4-FB0A-4EF9-A9D6-A0E1726A2FF8} 1620
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1672

C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe
"C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe" "C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe
  "C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe" "C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe" -burn.unelevated BurnPipe.{2D03D701-C92B-41F3-BC62-C9AACEB1F67C} {72713DC9-06A1-4FA2-8ED0-C7BE6305C057} 3968
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20241002232500.log
    3⤵
    - System Location Discovery: System Language Discovery
    - Opens file in notepad (likely ransom note)
    PID:1032

C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe
"C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe" "C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe
  "C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe" "C:\Users\Admin\Downloads\NoEscape.exe (2)\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe" -burn.unelevated BurnPipe.{1B7AAE7F-AA0C-46C3-96AD-D0297998B980} {C8C6B32C-3F8F-45B5-91BA-5E3C8C9BBB0B} 1920
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20241002232500.log

Filesize
5KB

MD5
ec644b574e0fa94bfb7c8522ecf1cf6d

SHA1
60acdbc93ec10ad8e56acf817021d45f9687cae0

SHA256
0dd3f54cd24038d4d368375240243a08f21b9d327cd0059b1d21b614f9068047

SHA512
1866624627f8f91b1e8a84cd2a8eb88ab068115f530a1d20afaf4772cd9c441148620f1825be61155a77cde0e476d1cafd4c3a32fcd0d0a768b643bba9f24636

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba1\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba1\wixstdba.dll

Filesize
118KB

MD5
4d20a950a3571d11236482754b4a8e76

SHA1
e68bd784ac143e206d52ecaf54a7e3b8d4d75c9c

SHA256
a9295ad4e909f979e2b6cb2b2495c3d35c8517e689cd64a918c690e17b49078b

SHA512
8b9243d1f9edbcbd6bdaf6874dc69c806bb29e909bd733781fde8ac80ca3fff574d786ca903871d1e856e73fd58403bebb58c9f23083ea7cd749ba3e890af3d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba2\BootstrapperApplicationData.xml

Filesize
12KB

MD5
d09ea7c6853eb312d755857d721bfab5

SHA1
925eefea246686823c4158be84fffa387381c187

SHA256
c0aa87e265d55d306a51e16fd57e32b59776f007b463886515c7ba93110cc317

SHA512
a320d9e81e9115fe15b71a9e2beffdf53eaa455d3d18bab3b5fa350b5d98f69161990d2d256295e99fc250f317eda23c8866ebeeda18c42957db29fd5a212302

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba2\license.rtf

Filesize
8KB

MD5
eba5faa2129cafec630b82adae942aa9

SHA1
52ba1e75accbef329f64ea75111666f643d8987c

SHA256
4d7b2abaab1c0d46260e5d48ad4ce4bbc3ec02c660838a9a578f1bead68d6b35

SHA512
2bc372d51ff28be5a7d8a957e3d98093d5cd8f88efa5dad914d6d5313cabbfbd1e93fff7ba46ff1ed90f9074f4d03cf8a244b9d22bcef88c562ff577921cba8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba2\thm.wxl

Filesize
2KB

MD5
fbfcbc4dacc566a3c426f43ce10907b6

SHA1
63c45f9a771161740e100faf710f30eed017d723

SHA256
70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce

SHA512
063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba2\thm.xml

Filesize
5KB

MD5
0056f10a42638ea8b4befc614741ddd6

SHA1
61d488cfbea063e028a947cb1610ee372d873c9f

SHA256
6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87

SHA512
5764ec92f65acc4ebe4de1e2b58b8817e81e0a6bc2f6e451317347e28d66e1e6a3773d7f18be067bbb2cb52ef1fa267754ad2bf2529286cf53730a03409d398e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\1028\license.rtf

Filesize
18KB

MD5
efa0e0316dbe1d01b04db8ae55216e89

SHA1
99e9a3879e14465d3abe47e03a0eb52ecb7c1fcc

SHA256
d5147ee2ba7826d5b68e0dc10fc2ac95079f89c38264c5648d924dec9290d085

SHA512
b544d5c585981ddadf1822403fff5a4765031c2b484ab88a821c626b88ca3286269b1914e2f39b7d25ae748b69c8bc8d5ce7141bf72acacc09e1888f623c3e38

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\1028\thm.wxl

Filesize
2KB

MD5
472abbedcbad24dba5b5f5e8d02c340f

SHA1
974f62b5c2e149c3879dd16e5a9dbb9406c3db85

SHA256
8e2e660dfb66cb453e17f1b6991799678b1c8b350a55f9ebe2ba0028018a15ad

SHA512
676e29378aaed25de6008d213efa10d1f5aad107833e218d71f697e728b7b5b57de42e7a910f121948d7b1b47ab4f7ae63f71196c747e8ae2b4827f754fc2699

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\1029\license.rtf

Filesize
11KB

MD5
fd8353f3bc88a47b8880b59a5dad3f03

SHA1
22e908ef2dd80221cde6c2bb1ae27099c5f5697d

SHA256
2428e8ba8fc9648422333b6b4b92fb476741fc1022de7cb59d030ec35cc21ac7

SHA512
44ff2df62cb7381eb247800ca4b9566747e1a7a2a2321a002d7f49681ecbc5e797c91b56ea80b99565d3acfcd38dd1444c616a7e17f5f4d2923e6124e99eb7f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\1029\thm.wxl

Filesize
3KB

MD5
16343005d29ec431891b02f048c7f581

SHA1
85a14c40c482d9351271f6119d272d19407c3ce9

SHA256
07fb3ec174f25dfbe532d9d739234d9dfda8e9d34f01fe660c5b4d56989fa779

SHA512
ff1ae9c21dcfb018dd4ec82a6d43362cb8c591e21f45dd1c25955d83d328b57c8d454bbe33fbc73a70dadf1dfb3ae27502c9b3a8a3ff2da97085ca0d9a68ab03

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\1031\license.rtf

Filesize
11KB

MD5
b4a1f60a329e18dd44c19f91e19e9a0d

SHA1
9a27b68a23be4aa2cbd1f0f4d4616df52a74134f

SHA256
c017edfe3b0d308e20fbf3de8795fd4451a530475a2d0ee0824e166045eadfb7

SHA512
d7e571b66271f82c275fe7b83c67679352b9b37aacbc13692346f8d56d01f4c61001b46c64f118f3165de39b5f6dd625703996e1a181743bfdf2263f50707067

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\1031\thm.wxl

Filesize
3KB

MD5
561f3f32db2453647d1992d4d932e872

SHA1
109548642fb7c5cc0159beddbcf7752b12b264c0

SHA256
8e0dca6e085744bfcbff46f7dcbcfa6fbd722dfa52013ee8ceeaf682d7509581

SHA512
cef8c80bef8f88208e0751305df519c3d2f1c84351a71098dc73392ec06cb61a4aca35182a0822cf6934e8ee42196e2bcfe810cc859965a9f6f393858a1242df

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\1036\license.rtf

Filesize
11KB

MD5
6f70759df32f212dbb65464258eceeaf

SHA1
f8c597e00968431a66dcdd79a8de95705976d39e

SHA256
c7f03da5d9a7f689b8dcbd507ff0b3fa98daba55616f902e5e47e9839b753e1f

SHA512
99309c17af1a323ab905a3b610b46b9ce9201cf7083103d990cc4c6b509f28743d99a9bc17dfa7e89ede4496bac30fd86c9356aba9f292bfbf591ce6b6b7ef3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\1036\thm.wxl

Filesize
3KB

MD5
7b46ae8698459830a0f9116bc27de7df

SHA1
d9bb14d483b88996a591392ae03e245cae19c6c3

SHA256
704ddf2e60c1f292be95c7c79ee48fe8ba8534ceb7ccf9a9ea68b1ad788ae9d4

SHA512
fc536dfadbcd81b42f611ac996059a6264e36ecf72a4aee7d1e37b87aefed290cc5251c09b68ed0c8719f655b163ad0782acd8ce6332ed4ab4046c12d8e6dbf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\1040\license.rtf

Filesize
10KB

MD5
1d07e27f97ce22a58780a04227be6465

SHA1
2fcd519823f1664c59a959acbee37093ec94f62e

SHA256
f1214784c57aa3323426af64d132045970717994eba500b25283684dc1adebaa

SHA512
d66965269c9ea755266f9a76221528213648e2aa7ab2e6917be356ece279acf69d0c1982fe3c4b8bd1bb79a094abe98ae6578c6f6ec311d46cd2950390b23fcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\1040\thm.wxl

Filesize
3KB

MD5
d90bc60fa15299925986a52861b8e5d5

SHA1
fadfca9ab91b1ab4bd7f76132f712357bd6db760

SHA256
0c57f40cc2091554307aa8a7c35dd38e4596e9513e9efae00ac30498ef4e9bc2

SHA512
11764d0e9f286b5aa7b1a9601170833e462a93a1e569a032fcba9879174305582bd42794d4131b83fbcfbf1cf868a8d5382b11a4bd21f0f7d9b2e87e3c708c3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\1041\license.rtf

Filesize
31KB

MD5
0d9dd57746d5609494b35314fa88fd93

SHA1
8a7a57681813ae27f9579427b086685143073d13

SHA256
ac0d8e0eaab1875909a6a6f106a37cd7468f87f71887a44263f5f0178f99c40b

SHA512
e365c8416c70581bb31629b8ec62c6581539a80c7a4c06d489c64978d84c55b37dac72c09d1a89a2344e07f0f59beb4f371d9c78f92d9903f431b3f0b94bbaf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\1041\thm.wxl

Filesize
3KB

MD5
dc81ed54fd28fc6db6f139c8da1bded6

SHA1
9c719c32844f78aae523adb8ee42a54d019c2b05

SHA256
6b9bbf90d75cfa7d943f036c01602945fe2fa786c6173e22acb7afe18375c7ea

SHA512
fd759c42c7740ee9b42ea910d66b0fa3f813600fd29d074bb592e5e12f5ec09db6b529680e54f7943821cefe84ce155a151b89a355d99c25a920bf8f254aa008

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\1042\license.rtf

Filesize
28KB

MD5
f6e7a2a05efb4413295c156a179578a3

SHA1
91036034ca0bbd9a30bfc0bc2045791d57e94005

SHA256
dcefd9b37d78f37ed8aaef70ac2bfcde441dcfb97469a6aa6af89c1ffadbf814

SHA512
029aa788a5b6e0194d5a52005cf0327c375196e54f7ebbce2758a3e6684d6ddf6765519564c272abf5ebebeaa5a1b4b3c3f0dc9b5377df151dca825fec02dbdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\1042\thm.wxl

Filesize
3KB

MD5
b3399648c2f30930487f20b50378cec1

SHA1
ca7bdab3bfef89f6fa3c4aaf39a165d14069fc3d

SHA256
ad7608b87a7135f408abf54a897a0f0920080f76013314b00d301d6264ae90b2

SHA512
c5b0ecf11f6dadf2e68bc3aa29cc8b24c0158dae61fe488042d1105341773166c9ebabe43b2af691ad4d4b458bf4a4bf9689c5722c536439ca3cdc84c0825965

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\1045\license.rtf

Filesize
12KB

MD5
a0d88589a339e57e412ab01e763d6a27

SHA1
e4b954832036d98943f2380dcce636473a84f9d5

SHA256
898d5ca01a3271d97350d06a6ccdb8803a176bb42baf7e2c8f76c9037235ca8e

SHA512
504e3939e96ec78e59ecda356b463b2e54aeb94026b97669428730acb202d73db510fc9c6b5060ac48dd564e0dd9896e1b65ab7e1d30c58c9f2a954cb585d704

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\1045\thm.wxl

Filesize
3KB

MD5
15172eaf5c2c2e2b008de04a250a62a1

SHA1
ed60f870c473ee87df39d1584880d964796e6888

SHA256
440b309fcdf61ffc03b269fe3815c60cb52c6ae3fc6acad14eac04d057b6d6ea

SHA512
48aa89cf4a0b64ff4dcb82e372a01dff423c12111d35a4d27b6d8dd793ffde130e0037ab5e4477818a0939f61f7db25295e4271b8b03f209d8f498169b1f9bae

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\1046\license.rtf

Filesize
9KB

MD5
137a9579ba2e02ebb87817440fcbdcb9

SHA1
fe033a175d4f0c766b95d67d5da933c608323159

SHA256
42dc678ef9d5e4e147bf178ffe2fa3cd4bbbf9c904872b4e344d8bb22c473ed5

SHA512
601d98c7994ea569cf5d0c74d4357503773cce1ec1d1701fc363fb66aa003c968900cd56a0702b3e8661da157367755b40d473fa870800936b02980b021931c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\1046\thm.wxl

Filesize
3KB

MD5
be27b98e086d2b8068b16dbf43e18d50

SHA1
6faf34a36c8d9de55650d0466563852552927603

SHA256
f52b54a0e0d0e8f12cba9823d88e9fd6822b669074dd1dc69dad6553f7cb8913

SHA512
3b7c773ef72d40a8b123fdb8fc11c4f354a3b152cf6d247f02e494b0770c28483392c76f3c222e3719cf500fe98f535014192acddd2ed9ef971718ea3ec0a73e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\1049\license.rtf

Filesize
53KB

MD5
eff73c35db2d6ac9f29d1b633c984a95

SHA1
05e1a450fd077607612aa0506143140ccc8017b9

SHA256
f00a2a67106ca3badb4c233951a262ec0a9bba3151e1d8da0362dcada7928dcd

SHA512
1d89c50b2b2ea63dd464268dab4272991d51e2d27a407440585be855d86e06b5982f685d797e8f7917e75512f72cc1496ff5f21466b4a649aba43458d8dbe8b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\1049\thm.wxl

Filesize
4KB

MD5
17c652452e5ee930a7f1e5e312c17324

SHA1
59f3308b87143d8ea0ea319a1f1a1f5da5759dd3

SHA256
7333bc8e52548821d82b53dbd7d7c4aa1703c85155480cb83cefd78380c95661

SHA512
53fd207b96d6bcf0a442e2d90b92e26cbb3ecc6ed71b753a416730e8067e831e9eb32981a9e9368c4cca16afbcb2051483fdcfc474ea8f0d652fca934634fbe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\1055\license.rtf

Filesize
12KB

MD5
362f60f539b629bf59021003f426583c

SHA1
c9dba340889aafd07996a8bfcab7c14f404e07a6

SHA256
1e602773f3071636e0f9c6b27037b7b4094dc26f7c2fabcdf3287bc9bcaa8652

SHA512
10f475bb075ebc597cfe1d2333f9b4b26109fec974e4517e9f77bc30d609ed47619f4347124274f85e9277b14ef52d7863d311bdc4176e7ae7fcb009420b15c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\1055\thm.wxl

Filesize
3KB

MD5
defbea001dc4eb66553630ac7ce47cca

SHA1
90ced64ec7c861f03484b5d5616fdbcda8f64788

SHA256
e5abe3cb3bf84207dac4e6f5bba1e693341d01aea076dd2d91eaa21c6a6cb925

SHA512
b3b7a22d0cdada21a977f1dceaf2d73212a4cddbd298532b1ac97575f36113d45e8d71c60a6d8f8cc2e9dbf18ee1000167cfbf0b2e7ed6f05462d77e0bca0e90

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\2052\license.rtf

Filesize
18KB

MD5
31afec54446e496ce2a1d1cd3b257738

SHA1
e2b4f4cf493929ad01edb33d9034f9129a15742e

SHA256
63f463f0ace41fa088acfb70f501db47e3b83600db31538d8daba010e6b83d42

SHA512
8f2bc3343109ce6c0e3ef9e81cffe96a70a56d5c5c28ee3ed2f933189818269c06a9dcf3b8783cc1ae0b379aa53a899cd6aaa59be7a9e0f9e0d51e587a533829

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\2052\thm.wxl

Filesize
2KB

MD5
3d1e15deeace801322e222969a574f17

SHA1
58074c83775e1a884fed6679acf9ac78abb8a169

SHA256
2ac8b7c19a5189662de36a0581c90dbad96df259ec00a28f609b644c3f39f9ca

SHA512
10797919845c57c5831234e866d730ebd13255e5bf8ba8087d53f1d0fc5d72dc6d5f6945dbebee69acc6a2e20378750c4b78083ae0390632743c184532358e10

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\3082\license.rtf

Filesize
10KB

MD5
64f1444d27e3f3489f057e7280e9c973

SHA1
3ddc843d2021f62994c6ed35ebc8a193c4045994

SHA256
55929413b6a530f8c4acbb1e7eee81fb9ed0bd64af5cd26d6f5637cedfaf0a2d

SHA512
8d9ac8300c5a6815d2afa02a54f23cb3a8b28192fa504c26f747fa3d4e70deb55f8c19ca4abf6e93856bcd1f1d9636a95e4e8f134d8d1e4ecc4081579f5b27cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba4\3082\thm.wxl

Filesize
3KB

MD5
47f9f8d342c9c22d0c9636bc7362fa8f

SHA1
3922d1589e284ce76ab39800e2b064f71123c1c5

SHA256
9cbb2b312c100b309a1b1495e84e2228b937612885f7a642fbbd67969b632c3a

SHA512
e458df875e9b0622aebe3c1449868aa6a2826a1f851db71165a872b2897cf870ccf85046944ff51ffc13bb15e54e9d9424ec36caf5a2f38ce8b7d6dc0e9b2363

Download Submit
memory/1580-79-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download
memory/1580-93-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download
memory/2152-94-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download
memory/2704-81-0x000001D9EC6A0000-0x000001D9EC6A1000-memory.dmp

Filesize
4KB

Download
memory/2704-86-0x000001D9EC6A0000-0x000001D9EC6A1000-memory.dmp

Filesize
4KB

Download
memory/2704-87-0x000001D9EC6A0000-0x000001D9EC6A1000-memory.dmp

Filesize
4KB

Download
memory/2704-88-0x000001D9EC6A0000-0x000001D9EC6A1000-memory.dmp

Filesize
4KB

Download
memory/2704-92-0x000001D9EC6A0000-0x000001D9EC6A1000-memory.dmp

Filesize
4KB

Download
memory/2704-91-0x000001D9EC6A0000-0x000001D9EC6A1000-memory.dmp

Filesize
4KB

Download
memory/2704-89-0x000001D9EC6A0000-0x000001D9EC6A1000-memory.dmp

Filesize
4KB

Download
memory/2704-82-0x000001D9EC6A0000-0x000001D9EC6A1000-memory.dmp

Filesize
4KB

Download
memory/2704-80-0x000001D9EC6A0000-0x000001D9EC6A1000-memory.dmp

Filesize
4KB

Download
memory/2704-90-0x000001D9EC6A0000-0x000001D9EC6A1000-memory.dmp

Filesize
4KB

Download