Malware Analysis Report

2024-09-22 07:01

Sample ID 240617-v2f75a1fnj
Target Nexustools.gg.exe
SHA256 7e40bb650228df04d61d8463be75c57f9ad590f5fd5b278cbb01de6a24741622
Tags
rat default asyncrat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7e40bb650228df04d61d8463be75c57f9ad590f5fd5b278cbb01de6a24741622

Threat Level: Known bad

The file Nexustools.gg.exe was found to be: Known bad.

Malicious Activity Summary

rat default asyncrat

Asyncrat family

AsyncRat

Async RAT payload

Async RAT payload

Downloads MZ/PE file

Executes dropped EXE

Unsigned PE

Suspicious use of SendNotifyMessage

Modifies data under HKEY_USERS

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-17 17:28

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Asyncrat family

asyncrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-17 17:28

Reported

2024-06-17 17:31

Platform

win10-20240404-en

Max time kernel

150s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\Nexustools.gg.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133631190595202011" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2456 wrote to memory of 4184 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4184 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2456 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe

"C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffea2ac9758,0x7ffea2ac9768,0x7ffea2ac9778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1788,i,17524078500066227605,237884018069532470,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1940 --field-trial-handle=1788,i,17524078500066227605,237884018069532470,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2088 --field-trial-handle=1788,i,17524078500066227605,237884018069532470,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2904 --field-trial-handle=1788,i,17524078500066227605,237884018069532470,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2928 --field-trial-handle=1788,i,17524078500066227605,237884018069532470,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4444 --field-trial-handle=1788,i,17524078500066227605,237884018069532470,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4636 --field-trial-handle=1788,i,17524078500066227605,237884018069532470,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4744 --field-trial-handle=1788,i,17524078500066227605,237884018069532470,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4684 --field-trial-handle=1788,i,17524078500066227605,237884018069532470,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 --field-trial-handle=1788,i,17524078500066227605,237884018069532470,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4776 --field-trial-handle=1788,i,17524078500066227605,237884018069532470,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5032 --field-trial-handle=1788,i,17524078500066227605,237884018069532470,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4752 --field-trial-handle=1788,i,17524078500066227605,237884018069532470,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2940 --field-trial-handle=1788,i,17524078500066227605,237884018069532470,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2968 --field-trial-handle=1788,i,17524078500066227605,237884018069532470,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4516 --field-trial-handle=1788,i,17524078500066227605,237884018069532470,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5348 --field-trial-handle=1788,i,17524078500066227605,237884018069532470,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 --field-trial-handle=1788,i,17524078500066227605,237884018069532470,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5428 --field-trial-handle=1788,i,17524078500066227605,237884018069532470,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5420 --field-trial-handle=1788,i,17524078500066227605,237884018069532470,131072 /prefetch:8

C:\Users\Admin\Downloads\Nexustools.gg.exe

"C:\Users\Admin\Downloads\Nexustools.gg.exe"

Network

Country Destination Domain Proto
N/A 10.127.0.199:3232 tcp
N/A 10.127.0.199:3232 tcp
N/A 10.127.0.199:3232 tcp
N/A 10.127.0.199:3232 tcp
N/A 127.0.0.1:3232 tcp
N/A 10.127.0.199:3232 tcp
N/A 127.0.0.1:3232 tcp
N/A 10.127.0.199:3232 tcp
N/A 127.0.0.1:3232 tcp
N/A 10.127.0.199:3232 tcp
N/A 10.127.0.199:3232 tcp
N/A 10.127.0.199:3232 tcp
N/A 127.0.0.1:3232 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
N/A 10.127.0.199:3232 tcp
N/A 10.127.0.199:3232 tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 195.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.200.14:443 apis.google.com tcp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 172.217.169.46:443 play.google.com tcp
N/A 10.127.0.199:3232 tcp
US 8.8.8.8:53 46.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.187.206:443 clients2.google.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 206.187.250.142.in-addr.arpa udp
N/A 127.0.0.1:3232 tcp
N/A 127.0.0.1:3232 tcp
N/A 10.127.0.199:3232 tcp
US 8.8.8.8:53 gofile.io udp
FR 51.178.66.33:443 gofile.io tcp
FR 51.178.66.33:443 gofile.io tcp
US 8.8.8.8:53 api.gofile.io udp
FR 151.80.29.83:443 api.gofile.io tcp
US 8.8.8.8:53 33.66.178.51.in-addr.arpa udp
US 8.8.8.8:53 s.gofile.io udp
FR 51.75.242.210:443 s.gofile.io tcp
FR 51.75.242.210:443 s.gofile.io tcp
US 8.8.8.8:53 content-autofill.googleapis.com udp
GB 142.250.200.42:443 content-autofill.googleapis.com tcp
US 8.8.8.8:53 83.29.80.151.in-addr.arpa udp
US 8.8.8.8:53 210.242.75.51.in-addr.arpa udp
US 8.8.8.8:53 42.200.250.142.in-addr.arpa udp
N/A 10.127.0.199:3232 tcp
US 8.8.8.8:53 cold4.gofile.io udp
FR 31.14.70.247:443 cold4.gofile.io tcp
FR 31.14.70.247:443 cold4.gofile.io tcp
US 8.8.8.8:53 247.70.14.31.in-addr.arpa udp
N/A 10.127.0.199:3232 tcp
N/A 127.0.0.1:3232 tcp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp
N/A 127.0.0.1:3232 tcp
N/A 127.0.0.1:3232 tcp
N/A 10.127.0.199:3232 tcp

Files

memory/512-0-0x0000000000800000-0x000000000085A000-memory.dmp

memory/512-1-0x00007FFE943D3000-0x00007FFE943D4000-memory.dmp

memory/512-2-0x00007FFE943D0000-0x00007FFE94DBC000-memory.dmp

memory/512-3-0x00007FFE943D0000-0x00007FFE94DBC000-memory.dmp

memory/512-4-0x00007FFE943D3000-0x00007FFE943D4000-memory.dmp

memory/512-5-0x00007FFE943D0000-0x00007FFE94DBC000-memory.dmp

memory/512-6-0x00007FFE943D0000-0x00007FFE94DBC000-memory.dmp

\??\pipe\crashpad_2456_IVRPEFOKSDUIJJAD

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 9d0097f80edd25f1402cd7faf7bc42ad
SHA1 b28948cdea32b28b9573c8723b292a8a76453064
SHA256 f91eb45d07ea786a8ef2180280b3ef7a67ee889d691abc16f551010840b09ca3
SHA512 4bea9b37bf6482a74b9359661abb3959dff1a8187c145cb529973af11950cfd4101d26b04a96f1ebe35985060d72ac7443825019d34075288b54943293b96d3b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b91e1d1d-dbac-4f1b-876f-3e872901ed75.tmp

MD5 01514125e84451ac4bba3155017578a1
SHA1 519ef77229a54650c20bb61ea8188deed2cca96f
SHA256 3f50883582405b73eaa163b9c53303fa5bb0c08a46d228d02f0edc1a68a68b2f
SHA512 396b1ed690f4ab3955738b1b09226fb8f732515d5190cc4ace22f5ef41a30757f0f1b3e99851062724d66ccfe903923329de6cbc41001f282311c69fde88dd81

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 22fba04b6424eef3633a0b5d110289c1
SHA1 f1ee66716abc7f0ccc09c97e127456b760de6654
SHA256 e0fb1d679d994a5a8f6039cc2bc359345534653adcc2716df6d05f8d52fc1a2e
SHA512 497a4b2e72c257d0eb2448183a1b961ac68e85d0709888def7279677a6d9a164555be2e03a6101a67a9819e73a51c2ad66690098ec51722a06aa9b3412a24489

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 aff60445c5d73148da07e6b5dbd8df73
SHA1 fda5524616dca1939fa8e177700c64d2872b7d8a
SHA256 8c69b55f3a7103744abdc9756037dc4d490370b76d00a290242da5f19610f1b7
SHA512 4dbffd44e8dd8856f3dbb4d6357a57fbba98b5c6d5a9616bd2bc9445c86d784b7171e168c36cf88198d1a3611c886a6c302684c9a0b5b47c78dffed5cc3caf7e

C:\Users\Admin\Downloads\Unconfirmed 424285.crdownload

MD5 432624ae69aca637cc06144d3868b936
SHA1 53396cd78900284d2f5be8f293c9e7457eff58f6
SHA256 7e40bb650228df04d61d8463be75c57f9ad590f5fd5b278cbb01de6a24741622
SHA512 a031cca8089936ec578bbad77868593ba2bfb903aab0d6eeae7729d9dbdbb3f29a7613ffee4e616b8c04a89fb272b17de2cc083a9dc11eead101463f8896d250

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 3070be6d17b7b64860dc4983fbe05bca
SHA1 3f5d16b6eb5216b8628981f327a80fb86e605c1c
SHA256 d8ae5a85fc6ebf1dce275c3a79a3e5560f5516964542c6903b017c3edddcb7ec
SHA512 f6f1ae0f4414559ceebd504ff67da1dc513a4b5e52a2c4039236ccbe44ed5632c1b8ecebd988aa2f58be04e2ad3a18bffd6fc169a8557ba359c8d6d1413f7de0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 e6cecc549a731a7ae84d598d16b28530
SHA1 4fca292c07f15c4866c40c46c7608d66f363c489
SHA256 e52e51098b6762d779a059d46c629d58d6a936b1d9b434d3ceb94b167735ec5a
SHA512 e3c438aac83a6a892c1e92bef5ecd13164bc8bac0089303c6813596837e09105e987a6ce567c84f7b72fe808803830e505e12e4f19921dbb6280a0e501a8a637

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 09d9f76b853eaf1172dc2f99a824de77
SHA1 ea514946d74f49cdf058c5bba416964cfb9039e2
SHA256 8f9306b878b17d3b3b6f2ebca446a45e7f95f83db596d7ff141223f32ec7d80d
SHA512 3bfbac0c216c550ac4fcc00f8131580ef908ebeca627f0632feabf3a02bb011ef0e56bf306b8fbcfc932fd3bd1ba02a3c67b23ba8dc9a922ea90d46492e8e75f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe59647d.TMP

MD5 9fe66c574014731d27aca92605680de1
SHA1 cbe5e8df785a6bf7b22161060683c5173ae9818c
SHA256 8a5151b9208c7c2f668b8c0dac75390aa4ebef5c9a8a7c7e4fa6600e956683af
SHA512 31ff5ae8f1c6280349b5443d81ac5cb0f4cb5f282657d8cab3562eb25e67ee087f3dbe4aff258a60c8d992b3f73815c0ff5a8803715d84f3febf495c14001878

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 0d937f7dd8e0d89208c79dcf75de7f5f
SHA1 c6378cc50420c2d20accc3322ac305f2d3f030ca
SHA256 e039260db7aa6f30a8c7c2ce8d69055c1d6c8fee92aad78787b82f931e6e8923
SHA512 e658c5068296bac38263ad4f3bc0a61fe047e978567746abe5b106b5a6db58d6825ed2cb6c0dc850dceb3782ca07e4f74f807cf5298d55bb787696621a588699

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 06a064427d8a592a77edb0ee227a421b
SHA1 afe9c67f790a73d5e58d38ae4399207beee5bbfb
SHA256 fbb351b297a2fae9400bb517053062b631e7d45d4c0934f8add265651b9eb0a9
SHA512 0421d179a476d5c41f2545f0888815ea855ea2ab7deeea6ce714853acf622c96f0e36ad26aab9021fd61e12d5e39fa10ac795ac0c46e53e56d7045f4cfba2ea2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 a457ad84973f6748c92ddd71baf728e4
SHA1 4a5bd952dbf11cb0abad9506ff309c61d971999a
SHA256 ef73e1efe1012688442580f747734a29a718593d81e37b4d8b160606636272e3
SHA512 cf8d90fcc52f7c59c5cbd40cebfaddeb891faabfcc207eb875d00f23ee0429351ca04029f242b86efa21eda7a10b5c8b102afbee2165143a97de23a23f8bfc25

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 fd3ffcc0a6d8c25c083c4f93157e78c8
SHA1 185cfd6486018afe35313b6911d398cc82d10552
SHA256 b1fc0bf71c8a6a6e85439c6f8807304202ede49eab6ff1aba0ed74cbf474faa9
SHA512 515062a9c4a7990c7fbd33233f9dc0a333a2299751bc3652dadd55dc3470f8d9877d244b4fb22fb5d2d8d18953fe04f72356314e602c76dc8969a29c10094598

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

MD5 0648fe3c69b90dafe10ec54e6a987137
SHA1 be9af3ae8b74bf503a5e61d4d2cf0cb28f23fed6
SHA256 205e31b5f00e12dec78029c7fb2f715a679c7441ed560a76b6ecbfaab5b89324
SHA512 61e01c2883e2a64a7f488b088b658acf0182540bb63d12e31860b0fc0ebbe0f588a1729cda93d3b7956b8216d7fc1ff0c59b818ce416d8e86eef3164ec69f3f9

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 17:28

Reported

2024-06-17 17:31

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

56s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe"

Signatures

AsyncRat

rat asyncrat

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe

"C:\Users\Admin\AppData\Local\Temp\Nexustools.gg.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
N/A 10.127.0.96:3232 tcp
N/A 127.0.0.1:3232 tcp
N/A 10.127.0.96:3232 tcp
N/A 127.0.0.1:3232 tcp
N/A 10.127.0.96:3232 tcp
N/A 10.127.0.96:3232 tcp
N/A 127.0.0.1:3232 tcp
N/A 10.127.0.96:3232 tcp
N/A 127.0.0.1:3232 tcp
N/A 10.127.0.96:3232 tcp
N/A 127.0.0.1:3232 tcp
N/A 10.127.0.96:3232 tcp
N/A 10.127.0.96:3232 tcp
N/A 10.127.0.96:3232 tcp
N/A 127.0.0.1:3232 tcp
N/A 10.127.0.96:3232 tcp
N/A 127.0.0.1:3232 tcp
N/A 10.127.0.96:3232 tcp
N/A 10.127.0.96:3232 tcp
N/A 127.0.0.1:3232 tcp
N/A 10.127.0.96:3232 tcp
N/A 10.127.0.96:3232 tcp

Files

memory/2300-0-0x00007FFD5BCF3000-0x00007FFD5BCF5000-memory.dmp

memory/2300-1-0x00000000009B0000-0x0000000000A0A000-memory.dmp

memory/2300-2-0x00007FFD5BCF0000-0x00007FFD5C7B1000-memory.dmp

memory/2300-3-0x00007FFD5BCF0000-0x00007FFD5C7B1000-memory.dmp

memory/2300-4-0x00007FFD5BCF3000-0x00007FFD5BCF5000-memory.dmp

memory/2300-5-0x00007FFD5BCF0000-0x00007FFD5C7B1000-memory.dmp

memory/2300-6-0x00007FFD5BCF0000-0x00007FFD5C7B1000-memory.dmp