Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    990s
  • max time network
    1054s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/03/2024, 21:33

General

  • Target

    NexusMClauncher.exe

  • Size

    78KB

  • MD5

    28bc9d7b03c0193c8e39356a3918c283

  • SHA1

    aa8a0449e50ab88b7581d030dae27656d3ce750a

  • SHA256

    e45f355a20da8f62a76ecfe9c4a8bf771a758da2a94e5f21b3f40fdf4e495577

  • SHA512

    17249d646e8b890fd2472b5b71637286fbf3d9d8e989b3b0bd8c4d8aa3358bc55dd8bcb7949a85f6f6a218bca0e079c967115715f1457e867c3ebec20b78a8d4

  • SSDEEP

    1536:h2WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V++PId:hZv5PDwbjNrmAE+6Id

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTA1NTYxMjI2MTEwMTc0ODI3NA.Gga7En.nff0UktfNY9-rOMpPI8K8TtWuYMsw82Ms30hDY

  • server_id

    1206669799229489283

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Executes dropped EXE 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NexusMClauncher.exe
    "C:\Users\Admin\AppData\Local\Temp\NexusMClauncher.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2140
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultffc378d7he1aeh436dh9119h9122626a096f
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1472
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa7eeb46f8,0x7ffa7eeb4708,0x7ffa7eeb4718
      2⤵
        PID:228
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,16276884740295558511,1643313799472286596,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
        2⤵
          PID:5192
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,16276884740295558511,1643313799472286596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:5200
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,16276884740295558511,1643313799472286596,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
          2⤵
            PID:5252
        • C:\Windows\System32\CompPkgSrv.exe
          C:\Windows\System32\CompPkgSrv.exe -Embedding
          1⤵
            PID:5464
          • C:\Windows\System32\CompPkgSrv.exe
            C:\Windows\System32\CompPkgSrv.exe -Embedding
            1⤵
              PID:5528
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
              1⤵
              • Enumerates system info in registry
              • NTFS ADS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:6108
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7eeb46f8,0x7ffa7eeb4708,0x7ffa7eeb4718
                2⤵
                  PID:2864
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
                  2⤵
                    PID:5600
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:220
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
                    2⤵
                      PID:5188
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
                      2⤵
                        PID:2488
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
                        2⤵
                          PID:4924
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
                          2⤵
                            PID:2976
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
                            2⤵
                              PID:5376
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3636 /prefetch:8
                              2⤵
                                PID:984
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3636 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5792
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
                                2⤵
                                  PID:5872
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
                                  2⤵
                                    PID:5868
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:1
                                    2⤵
                                      PID:4356
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
                                      2⤵
                                        PID:2980
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4276 /prefetch:1
                                        2⤵
                                          PID:5528
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
                                          2⤵
                                            PID:4132
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
                                            2⤵
                                              PID:2684
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1788 /prefetch:8
                                              2⤵
                                                PID:4552
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=1256 /prefetch:8
                                                2⤵
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:4312
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
                                                2⤵
                                                  PID:1652
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
                                                  2⤵
                                                    PID:5972
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
                                                    2⤵
                                                      PID:4836
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
                                                      2⤵
                                                        PID:5356
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
                                                        2⤵
                                                          PID:4984
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
                                                          2⤵
                                                            PID:2620
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
                                                            2⤵
                                                              PID:4168
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
                                                              2⤵
                                                                PID:4476
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6204 /prefetch:2
                                                                2⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:5936
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
                                                                2⤵
                                                                  PID:4420
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
                                                                  2⤵
                                                                    PID:1156
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1600 /prefetch:8
                                                                    2⤵
                                                                      PID:5000
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
                                                                      2⤵
                                                                        PID:5304
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6188 /prefetch:8
                                                                        2⤵
                                                                          PID:4464
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,16601679642907930814,11153442475813194407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6732 /prefetch:8
                                                                          2⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:4576
                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                        1⤵
                                                                          PID:2328
                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                          1⤵
                                                                            PID:4076
                                                                          • C:\Windows\system32\AUDIODG.EXE
                                                                            C:\Windows\system32\AUDIODG.EXE 0x464 0x4f0
                                                                            1⤵
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2884
                                                                          • C:\Windows\System32\rundll32.exe
                                                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                            1⤵
                                                                              PID:2460
                                                                            • C:\Users\Admin\Downloads\NexusMClauncher.exe
                                                                              "C:\Users\Admin\Downloads\NexusMClauncher.exe"
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:5436
                                                                            • C:\Users\Admin\Downloads\NexusMClauncher.exe
                                                                              "C:\Users\Admin\Downloads\NexusMClauncher.exe"
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:3968
                                                                            • C:\Users\Admin\Downloads\NexusMClauncher.exe
                                                                              "C:\Users\Admin\Downloads\NexusMClauncher.exe"
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:4780

                                                                            Network

                                                                            MITRE ATT&CK Enterprise v15

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                              Filesize

                                                                              152B

                                                                              MD5

                                                                              4b206e54d55dcb61072236144d1f90f8

                                                                              SHA1

                                                                              c2600831112447369e5b557e249f86611b05287d

                                                                              SHA256

                                                                              87bf9a4c3564eb3d8bef70450da843ae6003271222734c4d28d9961c52782e0b

                                                                              SHA512

                                                                              c9e8d2452368873e0622b002a0c2f8a2714b5897a09475738a9f9740122d716a9f0d3841725230d58e039564c820d32a6f3a675a7bb04bd163bab53dcb4e22f2

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                              Filesize

                                                                              152B

                                                                              MD5

                                                                              73c8d54f775a1b870efd00cb75baf547

                                                                              SHA1

                                                                              33024c5b7573c9079a3b2beba9d85e3ba35e6b0e

                                                                              SHA256

                                                                              1ce86be0476a2a9e409fcb817126285bc4ad83efd03ee06a2f86910fe18d4d94

                                                                              SHA512

                                                                              191344f5830cfea68499bd49073ffa7215a42265a9629d203d07849b2417c0ffdbdbf288bf2c669e91009a0d7e8bd6a6b378c92fc283049141231ca7bf4da3b8

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                              Filesize

                                                                              152B

                                                                              MD5

                                                                              8c758ec1c1c8331b564df2f61390f55a

                                                                              SHA1

                                                                              8e25ca49f0b792eebb15e1dfb0644e9772da8806

                                                                              SHA256

                                                                              e3ea8c3967e6a1a1ea855733c6c52e8ddb517fed68222133de90c7d75eeb46fa

                                                                              SHA512

                                                                              6f5e2b3ae039f99b5f1e9284f26534b14ea95dff1fd2eb68d4a79f410ff865da046d9dda95e8705d968aac528209e6639489dcde86c53f8cc186219c2f7008f0

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

                                                                              Filesize

                                                                              194KB

                                                                              MD5

                                                                              f5b4137b040ec6bd884feee514f7c176

                                                                              SHA1

                                                                              7897677377a9ced759be35a66fdee34b391ab0ff

                                                                              SHA256

                                                                              845aa24ba38524f33f097b0d9bae7d9112b01fa35c443be5ec1f7b0da23513e6

                                                                              SHA512

                                                                              813b764a5650e4e3d1574172dd5d6a26f72c0ba5c8af7b0d676c62bc1b245e4563952bf33663bffc02089127b76a67f9977b0a8f18eaef22d9b4aa3abaaa7c40

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              15c3a6bbac7373005af88f21b50cf5d5

                                                                              SHA1

                                                                              fa67b30cff8dce508c04d1ece09ca8ba93df591b

                                                                              SHA256

                                                                              8d278a3e33189b4a329a6267c4eac8a27f24e6a4cae4924d74a0edb66dbb64c4

                                                                              SHA512

                                                                              699d9bd2950b5c41057f04cb2d04d7bd3a531b4f5fc3cf3df88961cc457d61753f9434ec0ff45ce99f70ad0bc3a6c90e9381469aad69742855970ef508ec7481

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              8738757e7eff1dd9947056ca2593a0f3

                                                                              SHA1

                                                                              d6a18818795c4c1386d75263ac10be5ec10293c4

                                                                              SHA256

                                                                              d867b520fd9e40f288df0202b4a5e37acb0e78cc10680d1cec8f56ef4a7ff4fa

                                                                              SHA512

                                                                              91a00e44588ddefe66596726128ebeaeeb799520ecd18db540259977f4e5bd1612c6b691a65b0d0a5e391aef308d7db8b1ae8a04b41c1c741ea811ed38fa1c3d

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              eca69ffc11cac64a337c33274a518a4a

                                                                              SHA1

                                                                              add8a191e92fb8deddb43c1ffc59233508f91671

                                                                              SHA256

                                                                              fa610a75dfdc5c428116f0e02b6278075de07bb146c9e7bf669b0acba6c2feef

                                                                              SHA512

                                                                              f93359797dd618ea989307e361e5f96b35648b0ec6a9b6df15a4d9f4edf1d9fcf6db65dfb270edb911def5dd6b33bd2ceaf781ba8c0472709d7d72aac1b81541

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              be9aa4f8861600d7777a475c5bf33154

                                                                              SHA1

                                                                              deb72ca4c84a5ed4e751eaf5d9102634783910fe

                                                                              SHA256

                                                                              2eb2b13407186f8239787991bf7cbc67e26c667896800bbbdaed96bf4e641bf6

                                                                              SHA512

                                                                              681621efbaa9471301d123c16ce5d2012f56af4e86d1b107d03208bded3186d398e8c67b6e89c3363a8cf671885f9aa170b3a7c322dc48b5c4758fa1530e91ba

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

                                                                              Filesize

                                                                              16B

                                                                              MD5

                                                                              46295cac801e5d4857d09837238a6394

                                                                              SHA1

                                                                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                              SHA256

                                                                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                              SHA512

                                                                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

                                                                              Filesize

                                                                              334B

                                                                              MD5

                                                                              dbf34764632a2c42eb77242be670ef12

                                                                              SHA1

                                                                              8bb6ccc0710d9cae9c8b93546e2df9b46d87ada2

                                                                              SHA256

                                                                              9e61e546a24c60d9afb79e65b368429fabcce0cc210ddbf1c88a89f97def86fc

                                                                              SHA512

                                                                              6aecb1b39e4774196c1d152d9a120d60a321e30e34cf0cad75c48ed3b1673eb629cf9beeb852d49bd94dd08fb9bf406c70e778ba24a08a1ef8a94e48c417fc55

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                              Filesize

                                                                              180B

                                                                              MD5

                                                                              42eea3d789ad8d8f68e53cca4cab511d

                                                                              SHA1

                                                                              63d1b15db47d8e3ce0af33cb9af1359f3c98c8b5

                                                                              SHA256

                                                                              fac4a5a322ea932e685e7d5fffc1f921a125a190d4b279239b9deecd2a3d042b

                                                                              SHA512

                                                                              dcfcd6c7b017898abd7af74a9da1acd62dd43d84be15163160d9eba60229ee6d4f750bc5006f348a982871504f2f7b99ac6b5f6296c7cc6a970b05970fe3507e

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                              Filesize

                                                                              180B

                                                                              MD5

                                                                              00a455d9d155394bfb4b52258c97c5e5

                                                                              SHA1

                                                                              2761d0c955353e1982a588a3df78f2744cfaa9df

                                                                              SHA256

                                                                              45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

                                                                              SHA512

                                                                              9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              21f8555852176a0c88bc7ad10b2a0ddd

                                                                              SHA1

                                                                              909867a73fc5080c6c8388ab93380c080018ff1d

                                                                              SHA256

                                                                              34cf75b5f4e08be947a74ecd968494478160a7b905c87de4eb26c3227674c45d

                                                                              SHA512

                                                                              c8bb634c2d5b657f761086e067e7cce2e46a5e652879c0d84824a399b391c6e62239e61482ba8422062b9306ab3840b75da66cbcde9af2a2274ee92f8379c406

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              01cea959bb3320f7ffc49e80b7aa2271

                                                                              SHA1

                                                                              bb2b83faf1d418a3cafacd117097927bdfd84151

                                                                              SHA256

                                                                              a6ceb242e4807c4f60e61644b19cbd485adc1186501685983a527eedb2452608

                                                                              SHA512

                                                                              457733907126e75cb10e7d3303230a7309ad053b72cb2a01211338d0e4d173a41275754b54012d83b19302e900a8882ceebab38b28fac7a9c16befff2c1f41d6

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              8dda30aeb0fdde20067f339deb0b7eb7

                                                                              SHA1

                                                                              5972f32834f99ce54847674a48c76e321b1d8796

                                                                              SHA256

                                                                              0f0efba84f7754c3506272736986cb88b16df398d70c0bc42164ecfc3e105f48

                                                                              SHA512

                                                                              0cb3bd01058721119562465a8d8d67cb3ca7b125fec32dea754779f9c714f6ab5d908f697027426dab17ab296cfa69eccde8ea284332f77f47d92b45c0b16430

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                              Filesize

                                                                              5KB

                                                                              MD5

                                                                              aba5428cf58aae23ceac345ea50f623b

                                                                              SHA1

                                                                              0f92a183348afa7ea277a57927c634bc9ca0c9c6

                                                                              SHA256

                                                                              b5275d9e82f462aadcf433e11521de95022ccafd68bc05620c378cb46705eae0

                                                                              SHA512

                                                                              f6c623152ef8b9864075cbcbcc987f9b8caafef788228d7c8dca635c443fb2f3c9da6017a6c1449c80dd79f3fee934219c117fb31d9eae687e764a0bb0404de3

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                              Filesize

                                                                              6KB

                                                                              MD5

                                                                              8aa1f0bead52baeb3e4a1ff7c94a1416

                                                                              SHA1

                                                                              143f33921ca099f916de437277a2f9f6fc288910

                                                                              SHA256

                                                                              d027f8fd031ea3016378c21d7c3f0b98915ce7b2ff43ffb7335a377c8a56895e

                                                                              SHA512

                                                                              e65a01c91054f7def012ae49814bb80083cf03c74ba5945e58bb8c25d4b9d1fb8f4d424d47742222df8e1d726cf3b90db470feb54e4d302cfc3874aa9f3464df

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                              Filesize

                                                                              6KB

                                                                              MD5

                                                                              1477aae406b985044754b64c30f07c1a

                                                                              SHA1

                                                                              6928ede2653442133cf009cf352b3184ea700b26

                                                                              SHA256

                                                                              2f6dc5c3f39d6d7754dc3dfe03c78475d936895ea6311621a757437e097c702f

                                                                              SHA512

                                                                              47ac02b2ac682e5ededc3e28560c18820ed08f0b60f4d9ab429dd65d09bb8e692a43fd435592f621a52129e43247d2f17455973253f2a5a02bb5ed20020621d6

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                              Filesize

                                                                              6KB

                                                                              MD5

                                                                              4d3c5fe80e675561d597fdc3e2277e7c

                                                                              SHA1

                                                                              e76d2270f25f8e8a419df4519fa10bf0c7d34f09

                                                                              SHA256

                                                                              3d2e191d191ff4572a4cf866b09d21303da10430af5abc797145afc43e8ca677

                                                                              SHA512

                                                                              b75b600c2d4f3fdeaa61c025a0125281d56d754011c563849747405035d54413cd66b3990fc5bbedcb3f052ed1b53a14efa88e68dc40bce9f3134225ded98575

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                              Filesize

                                                                              7KB

                                                                              MD5

                                                                              93b688b2ea749394f12890dd72b14a89

                                                                              SHA1

                                                                              9ca2197baf1e3d8cb380bfa6c972a7da2f31ce29

                                                                              SHA256

                                                                              cce9a67e14958626b1b8ffc1db0c9c1c79941ac1f466e6677e520c647e659b03

                                                                              SHA512

                                                                              831c883ee6e0f452897d722bf8de99a215ac05936ad0c1dae6f3934de0563d6ba72ba8a758e758b7facc3c1fed8fea9279902a9c00b7b3c0dfdbbc4f714198e7

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                              Filesize

                                                                              7KB

                                                                              MD5

                                                                              7697d004aef538748cb8bf20a843c2cd

                                                                              SHA1

                                                                              270e0a513eb41bae450a0579cd21abde0ac79e3f

                                                                              SHA256

                                                                              8453e966d311300407dd3f169427690ad55e99a191421f0cd7f2aca0f7774855

                                                                              SHA512

                                                                              42f3c999fa90a39a8727489e044cdec52cd58debf1a45374f2e00b30d2cfc30d04aea44e9743f843c76fc2c72b96b54472d5d4c7111407c90548f3753323c47f

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                              Filesize

                                                                              7KB

                                                                              MD5

                                                                              d213b8ba053211d4d2a5d748677f8738

                                                                              SHA1

                                                                              e9dcc2373f721d9bb5ad6c84d13d9885b547f8d2

                                                                              SHA256

                                                                              82cc2af96a3cf92fa1702a4930d9dc8bc975f8d92e0eb9832e1f98b72d1365b5

                                                                              SHA512

                                                                              0d068886f116b49ce9c3cf651fbfc74cb0bb6f2d43ef29eacd6313af565f2303305be50801c09c8d4df34690a557ccdd679482a5453cd8433ae2555248a06dee

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                              Filesize

                                                                              8KB

                                                                              MD5

                                                                              a80463bdc8481f65a1a76c48be4c2437

                                                                              SHA1

                                                                              43d0dbf6b70f7c5228949d0de39655ed1d7a76df

                                                                              SHA256

                                                                              e1b83e95ba8a3b9e5079266b0b73bbd0550a522a7697d99957badbf1d1e0e9aa

                                                                              SHA512

                                                                              5ab3448f3982201ac9b07e8d823d660f350871d7f4adf9c8dcf51f254740245dec9f46126e575e9ef0febcb5bd6463be2adc7070cf592651345ffcc1b01fa82f

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                              Filesize

                                                                              8KB

                                                                              MD5

                                                                              d0a917806f4431e35c46517e22fc518d

                                                                              SHA1

                                                                              beb3c0f836304b3d91857a5082789b577f23cd2a

                                                                              SHA256

                                                                              60483e87474af38451246e653dee6a67ccd3fbfcc23024c5b142bc86bf43c26a

                                                                              SHA512

                                                                              5f85ddf123d79748105fe8d0ab1171b5b1473f3da9432664090b6ab4aaa794b9f73d732b9a1781881817dd9a98def9d20b965c0e4eccb39b5e5a150935713867

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

                                                                              Filesize

                                                                              41B

                                                                              MD5

                                                                              5af87dfd673ba2115e2fcf5cfdb727ab

                                                                              SHA1

                                                                              d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                              SHA256

                                                                              f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                              SHA512

                                                                              de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                              Filesize

                                                                              72B

                                                                              MD5

                                                                              81187686882c543f304dd35c6ea8b1ae

                                                                              SHA1

                                                                              816fa3339de6717cd557f255bc7ec52c6cc1699f

                                                                              SHA256

                                                                              f66c4478873fa8b617211dacd54baccd2b135016d1c8d9c1579f6548c0439515

                                                                              SHA512

                                                                              4fc03ba6e8e4abbbee7f8ff664da578db856bf037787abfb24047beda90e69c9b3e6e07950e151cbb008a316dbbea511b2a332aa08385a15dc1af7ae6a305740

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5d4dd4.TMP

                                                                              Filesize

                                                                              48B

                                                                              MD5

                                                                              ce30d8a6b8733316e0c5cbed7c930ae8

                                                                              SHA1

                                                                              9cf27511937f15e72ef2ea2d62196d8078af1443

                                                                              SHA256

                                                                              55c3fae382f1466540ed204d6c8e02c5c72c86d3a507e527d6a87d5496291ac6

                                                                              SHA512

                                                                              0274c5bb6fa6c31624208e474519cc8fc16d23b3f397e20096d2c7b2e8fc1047103498f81503d24858a5e647e30ab8ac8f841b7692ef3270a73eae789a4fec81

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

                                                                              Filesize

                                                                              347B

                                                                              MD5

                                                                              6dfa8892b17d13fcf803179db1216692

                                                                              SHA1

                                                                              e0d9222bfaa2b9cc96a9fa85951eb17dbfe2de24

                                                                              SHA256

                                                                              659a3f8ded77a5484538b02d579bd028b3352e988afeea69b8154dec85630234

                                                                              SHA512

                                                                              07ef36e9781db1f1f49295656f6d9bae88ae3312f0e084bdacb7062276ffa41002050f34f9def67dedbf3840ae2c5ec491aee55d10a8d910c87bf25eb94d5888

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

                                                                              Filesize

                                                                              323B

                                                                              MD5

                                                                              aba83638ed51df337dcab5dda693eb9f

                                                                              SHA1

                                                                              b2e5efcc3ba82c5d84f6f7b5d947dea70d3ab55f

                                                                              SHA256

                                                                              2c92059ce041741b222698ccf4d442f089795626c99d54d6ab43535907a20fcb

                                                                              SHA512

                                                                              d94708ff8b65e8de65796b7a84c02e548c4df740e4ca4a7ceb5c880177d6cd877ce53cfdce1f8af4774274155f203c1ca03591ccb355fb21eaa60d8df56fab18

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                              Filesize

                                                                              705B

                                                                              MD5

                                                                              b150c108abab56fa895edf039e64cb0c

                                                                              SHA1

                                                                              ceffba27b598250c291d84d42d416ae680335db2

                                                                              SHA256

                                                                              0f44ec3a767e9b565e9cae6c6fec7e8ec26ff5e20ce067305eafce39717f9277

                                                                              SHA512

                                                                              4ae8e33dc311d0c63491f690481959bb1c6934e309b3d1c18dc4e268e7e558af71a0daa4782128a7c14bff9a7cd661a22dd3dc5ba8c7192763d67acbf19790ba

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                              Filesize

                                                                              705B

                                                                              MD5

                                                                              8c3dcd850e1e09942ff01d2f12059d35

                                                                              SHA1

                                                                              e9b0aa3aba6cbb8f01ff36022c2aa7feb69adad8

                                                                              SHA256

                                                                              53f217c0c79ce3919e83eac4a50aba2e7ccf10320c1829c7c39537fca5cc0e07

                                                                              SHA512

                                                                              faf2201454c9a4d7b48ee8cf0682f40ddf5bcdef57b924cb1f0e6c278fea13916daf8cec6aff39486826d4aeba19cec883c8faa38706dec2a2a4a66b50b3619c

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                              Filesize

                                                                              705B

                                                                              MD5

                                                                              a31a9e3fc410f7c61f4ee0b5ec438bab

                                                                              SHA1

                                                                              2e972a540ca5e29c66e832e9c70ac462e325405a

                                                                              SHA256

                                                                              e2c0a2faa0618fe237541be520cb411ba89635eb2fa8b5aa5528be66c36513f1

                                                                              SHA512

                                                                              041ece0dbd43d2d4bf6a9e754dff32fe72c27daa180329c0670c6b8c0ccf2cf4abd59cf39dbebad114f1a22c89c011eec147f7d37558a51ff31ffddeb63c1907

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                              Filesize

                                                                              705B

                                                                              MD5

                                                                              4db21555e72aefaa984d49008a9c7715

                                                                              SHA1

                                                                              6308832c8445472b85696a73677dc3a9a3178915

                                                                              SHA256

                                                                              38867eef97f13706ad2ba603fe24f33e701b63b5d8efe4dc862f2d65864e8c33

                                                                              SHA512

                                                                              daf3598c41dd854857241efcaede99fc95769c27387d4cef78fa78efb6260aa87861dfce53ae39ab533055ab2dc27d5b42cdf3c1f67aee2b671e7707afcdd44c

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                              Filesize

                                                                              872B

                                                                              MD5

                                                                              8c98011ce200b027f5de290e9c4b9a1a

                                                                              SHA1

                                                                              ad2b308d0a10f5a00fc494a9742cbdfddbf060d2

                                                                              SHA256

                                                                              8107db94b27892ef1efe68a7b726c9f3c822ede476cab766f97f28e7c7a12eef

                                                                              SHA512

                                                                              c396358d674eefbf87cdd35cd44286c2b804e8f71655cc88a351c87c64d226e5820ca714733feb954d2c461205849f552cde0b4909a61e8de520212945808298

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a280b.TMP

                                                                              Filesize

                                                                              537B

                                                                              MD5

                                                                              c66650f41d6d830dc8cb0d07a89cb1dd

                                                                              SHA1

                                                                              4c07e06ceaab58df1034009fe07021e77f716e82

                                                                              SHA256

                                                                              621779cdc2c8716ef01d670537a1918e6258d3053b98e3f4502a119316a65067

                                                                              SHA512

                                                                              b1f8ecc798ed2da816c796d4ed19da70f70dd6ba36f9e84c4a512d56f2f4ee5cc9f110922e61cad01177c45d805991bc581491d6348c2b5bf4690acb71df76d8

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                              Filesize

                                                                              16B

                                                                              MD5

                                                                              6752a1d65b201c13b62ea44016eb221f

                                                                              SHA1

                                                                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                              SHA256

                                                                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                              SHA512

                                                                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

                                                                              Filesize

                                                                              11B

                                                                              MD5

                                                                              838a7b32aefb618130392bc7d006aa2e

                                                                              SHA1

                                                                              5159e0f18c9e68f0e75e2239875aa994847b8290

                                                                              SHA256

                                                                              ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

                                                                              SHA512

                                                                              9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                              Filesize

                                                                              8KB

                                                                              MD5

                                                                              ee51589ed2d7af821f1bd836fdd7c852

                                                                              SHA1

                                                                              ce0843432781bc2acc41bc5df78f97a82757da01

                                                                              SHA256

                                                                              1add80153c0ab3f07e1544658cb7c45d12d4d5b03cac8cba60343c1163c7c755

                                                                              SHA512

                                                                              d6550abc3e141d582b69f90b09998ed798305454b84e6f2e60be9f51902c38dd1750c57b18aebb8385fea5306c80f68f0949a6263bc8a2e19a69a04d831e00e6

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                              Filesize

                                                                              12KB

                                                                              MD5

                                                                              4c893145415bb8eade83a80bfdac526b

                                                                              SHA1

                                                                              75ea985e6e5b88e472757b00fba91037995e60fa

                                                                              SHA256

                                                                              31f3c30f8c1dce9bd9301f308988bc92e3307b17795ab74075d325028b80987d

                                                                              SHA512

                                                                              164c3f3dfca6461d6ad686a100b87f0d8a02d4516c44b2670382718f6c863c4fb32ba258a7cde9a33a23e68be170adff8d71d2727688f0b73ce15aa25426f422

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                              Filesize

                                                                              11KB

                                                                              MD5

                                                                              dda0e62f628f3d3d6fabebfd6297d9db

                                                                              SHA1

                                                                              4b2dc0743f00a0741e2d0c4ece4c3584a9ac83d6

                                                                              SHA256

                                                                              3d02b4030124d5c28814cb84acc6fa1cb8164805118d899f523a246c68373bec

                                                                              SHA512

                                                                              bb26355e2f0d4b207df01f07342734b936dd8de2cf6208984b61e250ce8d0a0adab12d51cd37ff5a2a1ca5ed15e7fffefcf5ed05e92130f4d21d0d9f53aff501

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

                                                                              Filesize

                                                                              264KB

                                                                              MD5

                                                                              f50f89a0a91564d0b8a211f8921aa7de

                                                                              SHA1

                                                                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                              SHA256

                                                                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                              SHA512

                                                                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                                              Filesize

                                                                              11KB

                                                                              MD5

                                                                              28691c4248870f41d31412fb4d693baa

                                                                              SHA1

                                                                              54b4390245e4e056ece34f45f8a527fcc8d336a8

                                                                              SHA256

                                                                              8f4785088a9af9a1951586d50fb11d14ea42202a9e5549076e78bcb163b58956

                                                                              SHA512

                                                                              92624dc536a0ed4f9b95b24c167c64b1a79a3b2db7541225b8b7876fe8c223e28fc1f581927b796516e44e768743d5fd10293a09d4b200c6bef7ea529c70fa90

                                                                            • C:\Users\Admin\Downloads\NexusMClauncher.exe

                                                                              Filesize

                                                                              78KB

                                                                              MD5

                                                                              28bc9d7b03c0193c8e39356a3918c283

                                                                              SHA1

                                                                              aa8a0449e50ab88b7581d030dae27656d3ce750a

                                                                              SHA256

                                                                              e45f355a20da8f62a76ecfe9c4a8bf771a758da2a94e5f21b3f40fdf4e495577

                                                                              SHA512

                                                                              17249d646e8b890fd2472b5b71637286fbf3d9d8e989b3b0bd8c4d8aa3358bc55dd8bcb7949a85f6f6a218bca0e079c967115715f1457e867c3ebec20b78a8d4

                                                                            • memory/2140-1-0x0000023E69540000-0x0000023E69702000-memory.dmp

                                                                              Filesize

                                                                              1.8MB

                                                                            • memory/2140-55-0x0000023E698F0000-0x0000023E69900000-memory.dmp

                                                                              Filesize

                                                                              64KB

                                                                            • memory/2140-4-0x0000023E69E30000-0x0000023E6A358000-memory.dmp

                                                                              Filesize

                                                                              5.2MB

                                                                            • memory/2140-3-0x0000023E698F0000-0x0000023E69900000-memory.dmp

                                                                              Filesize

                                                                              64KB

                                                                            • memory/2140-2-0x00007FFA88FC0000-0x00007FFA89A81000-memory.dmp

                                                                              Filesize

                                                                              10.8MB

                                                                            • memory/2140-0-0x0000023E66E70000-0x0000023E66E88000-memory.dmp

                                                                              Filesize

                                                                              96KB

                                                                            • memory/2140-54-0x00007FFA88FC0000-0x00007FFA89A81000-memory.dmp

                                                                              Filesize

                                                                              10.8MB

                                                                            • memory/3968-799-0x00007FFA88FC0000-0x00007FFA89A81000-memory.dmp

                                                                              Filesize

                                                                              10.8MB

                                                                            • memory/3968-789-0x00007FFA88FC0000-0x00007FFA89A81000-memory.dmp

                                                                              Filesize

                                                                              10.8MB

                                                                            • memory/3968-802-0x0000014BA6A90000-0x0000014BA6AA0000-memory.dmp

                                                                              Filesize

                                                                              64KB

                                                                            • memory/4780-801-0x00007FFA88FC0000-0x00007FFA89A81000-memory.dmp

                                                                              Filesize

                                                                              10.8MB

                                                                            • memory/4780-803-0x00007FFA88FC0000-0x00007FFA89A81000-memory.dmp

                                                                              Filesize

                                                                              10.8MB

                                                                            • memory/5436-786-0x00007FFA88FC0000-0x00007FFA89A81000-memory.dmp

                                                                              Filesize

                                                                              10.8MB

                                                                            • memory/5436-787-0x00000158D46D0000-0x00000158D46E0000-memory.dmp

                                                                              Filesize

                                                                              64KB

                                                                            • memory/5436-783-0x00000158D46D0000-0x00000158D46E0000-memory.dmp

                                                                              Filesize

                                                                              64KB

                                                                            • memory/5436-782-0x00007FFA88FC0000-0x00007FFA89A81000-memory.dmp

                                                                              Filesize

                                                                              10.8MB