hxxps://mega[.]nz/file/8zdVADbQ#zgBChae6OAWDlXIIXvyN2uTShbQUcxQkIfMD9eQhdQM

max time kernel
324s
max time network
325s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
29-08-2024 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/8zdVADbQ#zgBChae6OAWDlXIIXvyN2uTShbQUcxQkIfMD9eQhdQM

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NexusFN.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 60 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 = 50003100000000001d599c3b10006e65787573003c0009000400efbe1d599c3b1d599c3b2e0000004f5e020000000300000000000000000000000000000007c1c6006e006500780075007300000014000000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\NodeSlot = "3"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	NOTEPAD.EXE

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\nexus.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\socks4 (18).txt:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\cheaphotmails.txt:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 3 IoCs

ransomware

pid	Process
4060	NOTEPAD.EXE
2008	NOTEPAD.EXE
4748	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
676	msedge.exe
676	msedge.exe
4044	msedge.exe
4044	msedge.exe
2292	identity_helper.exe
2292	identity_helper.exe
3492	msedge.exe
3492	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4464	msedge.exe
4464	msedge.exe
4044	msedge.exe
4044	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	1512	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1512	AUDIODG.EXE
Token: SeDebugPrivilege	928	NexusFN.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2008	NOTEPAD.EXE
2008	NOTEPAD.EXE
2008	NOTEPAD.EXE
4060	NOTEPAD.EXE
4060	NOTEPAD.EXE
4060	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 676 wrote to memory of 1884	676	msedge.exe	80
PID 676 wrote to memory of 1884	676	msedge.exe	80
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 3768	676	msedge.exe	81
PID 676 wrote to memory of 4780	676	msedge.exe	82
PID 676 wrote to memory of 4780	676	msedge.exe	82
PID 676 wrote to memory of 3064	676	msedge.exe	83
PID 676 wrote to memory of 3064	676	msedge.exe	83
PID 676 wrote to memory of 3064	676	msedge.exe	83
PID 676 wrote to memory of 3064	676	msedge.exe	83
PID 676 wrote to memory of 3064	676	msedge.exe	83
PID 676 wrote to memory of 3064	676	msedge.exe	83
PID 676 wrote to memory of 3064	676	msedge.exe	83
PID 676 wrote to memory of 3064	676	msedge.exe	83
PID 676 wrote to memory of 3064	676	msedge.exe	83
PID 676 wrote to memory of 3064	676	msedge.exe	83
PID 676 wrote to memory of 3064	676	msedge.exe	83
PID 676 wrote to memory of 3064	676	msedge.exe	83
PID 676 wrote to memory of 3064	676	msedge.exe	83
PID 676 wrote to memory of 3064	676	msedge.exe	83
PID 676 wrote to memory of 3064	676	msedge.exe	83
PID 676 wrote to memory of 3064	676	msedge.exe	83
PID 676 wrote to memory of 3064	676	msedge.exe	83
PID 676 wrote to memory of 3064	676	msedge.exe	83
PID 676 wrote to memory of 3064	676	msedge.exe	83
PID 676 wrote to memory of 3064	676	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/8zdVADbQ#zgBChae6OAWDlXIIXvyN2uTShbQUcxQkIfMD9eQhdQM
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa7c973cb8,0x7ffa7c973cc8,0x7ffa7c973cd8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1888 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3024 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2652 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7032 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1520 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7412 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1736 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7400 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1872,9797939218111313659,15985579848169226536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7456 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4220

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004D0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2808

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\nexus\combo.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
- Suspicious use of SetWindowsHookEx
PID:2008

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\cheaphotmails.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4748

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\socks4 (18).txt
1⤵
PID:4640

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\nexus\proxies.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
- Suspicious use of SetWindowsHookEx
PID:4060

C:\Users\Admin\Desktop\nexus\NexusFN.exe
"C:\Users\Admin\Desktop\nexus\NexusFN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e2612636cf368bc811fdc8db09e037d

SHA1
d69e34379f97e35083f4c4ea1249e6f1a5f51d56

SHA256
2eecaacf3f2582e202689a16b0ac1715c628d32f54261671cf67ba6abbf6c9f9

SHA512
b3cc3bf967d014f522e6811448c4792eed730e72547f83eb4974e832e958deb7e7f4c3ce8e0ed6f9c110525d0b12f7fe7ab80a914c2fe492e1f2d321ef47f96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8115549491cca16e7bfdfec9db7f89a

SHA1
d1eb5c8263cbe146cd88953bb9886c3aeb262742

SHA256
dfa9a8b54936607a5250bec0ed3e2a24f96f4929ca550115a91d0d5d68e4d08e

SHA512
851207c15de3531bd230baf02a8a96550b81649ccbdd44ad74875d97a700271ef96e8be6e1c95b2a0119561aee24729cb55c29eb0b3455473688ef9132ed7f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
30KB

MD5
d1ac99f22b8d1149ba74efd60d894819

SHA1
29a846bd46ecab2c9fa87d1a86fae6c08e642b70

SHA256
4b87080fbb2db7330df4068005d45c3339a603f29579731eca94ed8dfff88ddb

SHA512
67cf99b90dba66196ff724f2c4d6fba333d88cca9cc42312530973f2f145cc24b3669178ab7c32e254d957ff84078edaf4fd9918ae2631f75e5cbb2fe10cf416

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
34KB

MD5
118ac39cff9e828be993490f864266ff

SHA1
ae5df00b1ffe0cc28ff84dac418a866540267d8b

SHA256
4a81760dfecd6b4890a7ad37ad772d15a7dbc8cc409fcb48a0501ee75cd55767

SHA512
88272ad598555ff57f316466c7625f53b07bcc5e65f11f44573712dcd6144a4ac2e32b11c7547b06552168299b8b7b01dadce6dfb92fc99289bb9ca562b621e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
102KB

MD5
94f16cfc0d63c0632a7ffcfea76602e7

SHA1
4e721cd4a07875e4028c56fc0743b9cd9c45c650

SHA256
4343702def9ed11dc8db2489f03d38cdc08cbfa2bd8a8f869920aacb8f33ff28

SHA512
2257c5aa0e6ce80445778866468efb04a9a07b60872a420b8617d3a7c653055207321458f27018e3fee002aef2733cf62eec1ca6aa573baf757d331f7b57e01f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
91KB

MD5
610f9799bdf95232bb7d9e6b5cfee168

SHA1
85315fd506adbede2200977518516c287f417e74

SHA256
22dd1cd645b44adffd6efbfcbab21817a31c660fc89b23738c439489f6b1ff06

SHA512
dc33bd92733a38c5f72e2e63f9b11e960a0ee108c27f0889a7438c33361fa7dc0f13db8f421e8b7321b3b837aa6acc8aad395dd9b4d72062a1e26476397206c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
212KB

MD5
2257803a7e34c3abd90ec6d41fd76a5a

SHA1
f7a32e6635d8513f74bd225f55d867ea56ae4803

SHA256
af23860fb3a448f2cc6107680078402555a345eb45bc5efb750f541fe5d7c174

SHA512
e9f4dc90d0829885f08879e868aa62041150b500f62682fc108da258eee26ad9509dcbf6e8a55f2d0bdba7aa9118dd149a70a7d851820d4ea683db7808c48540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
d69efe2ba1eb62afe4c303818c6e9e8b

SHA1
c02a2bbf20f1eeeb7589d2b5d6e0474f935837a7

SHA256
f3647d8d75ea331d3cbd1c9460fe8d2b8cad3e97de301446ccdf24983f8839ec

SHA512
dd21073c73cd72bcbf17c9d3e522ec84606fbf639a0a97360e68f77008a8985519fa80a1daa5a792f1f89583af0eead1a3120693aafa126f953c7b370dc8fa21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
bf8e92db5170fef1a6cc27cf81dd42d2

SHA1
d8e72e6592e71bd846eee9c2eec6049fbff5b738

SHA256
01a445180b6020cce4d90bef6299af3535abfa63c5b1a8002c481fd7a59a2065

SHA512
84bf644e7d832749b0008bfb18eef96b026fc90acd8ee14106b4ab989ab9a562d30cd9e4baeb3bef45b8a0fa08f1102b2a2de8e89d8cd351e7eb3ec2c28ee65f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c7ba6b3a91f19775b8d9af14c2979e8e

SHA1
2714da6a577ebf04b1e17a4aaa4243132494f15c

SHA256
33dda2726132305aed8db8fb33cb6b72db85f56224d73ce2f96339f69c96c1d6

SHA512
633a02862385289f4cfbb2a2282d863658a4307a78f8a7df077e5aa147274fbd6522791a2de203938c996c52a05305c4163ff8b8cbea59494de23ee02c2fcf48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
42295f5f04940c9074151c5b35df2de9

SHA1
dec0bf850180eb4d6d40c13eb63c2afbebfaffdd

SHA256
131c320f89709b599a094eada44088975bf42bc5a92b3e29fccc6eedc4f093dd

SHA512
27cfbf221abaeebc24bbd80196470ee638973f20bd65b8a86aa835d1411e03207a7568d873ab15d9247933aec805fb997cbd268242aca0ba5059fdf3d71776f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9cc77b78a0dbf4764f3172a79ba99253

SHA1
efafdc63b002874fad232e6aa5c5f41799dfdd36

SHA256
a590cc672f444e6f2a688a50c413f9d4445d9dce36896d7b00d49228a299a585

SHA512
2739f12e52269a232fd3e6b868ebd96712a4e3dcd892b8e3b75146f45760b12eb13cc5f172882e4878ed223d0045e51a04f9f8b886430aa73b29aa121feb6072

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6ca0acc2f5069ee4f9f2491de5d4c785

SHA1
054825f552adc8cd456349a650199a42ef5569a7

SHA256
65e85fc84b4e231dd208c7a9a84b47b70e258befbb997f0a03255f6818833fa3

SHA512
e9d3649452c10e1e07f598a42b28c1e8babbd3f5995dc7334f60ee3fcdf8ea20f3f12a007348edd356803e9f962ffc3c0dd9b292cb326b2bdee8b7c518768a17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1ba85f25cc6f1dc0db7e0ea93c556c20

SHA1
2cef13177306ecc1ef7bf0cf506fa9e026f5b6ea

SHA256
56f048dc086ee86adf301f361290471c0bf6fb7124cbc2a650bf8ba783f35b1f

SHA512
f2f1dc7c6da421575b91ae3f90b18145c2104b36a9f8ac106715aaff2e67cc872da168ebe7067aec2afc8c4d6e3372ed9c0b04376034a6925613303757765472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
eb6b0e58d6ab7d6ad84ec93b5b026313

SHA1
47dabc23693b4931e5d6f56d22392443eb82c774

SHA256
033691e68008d5ac744076bb0e55598d0a645ede92884e6970cc0226e86bd34b

SHA512
ff516179efb5f65a0f798da181788e00a545d2063ff5052e29077c51737272f30a28a6d4959c39c5429bc987a403f4e1aedacd8465316c2cff7a005d84ff232a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
61ac96236b5b8cdc3ec0d810b9124431

SHA1
ded5d1b9a6d27f11b5ee7c3146b1dd195d2867c3

SHA256
0d513e3fb62fc6e3a9e3847834d71731eefd8e4d82208bdee1a0d8a88c9fef40

SHA512
7f997c4beef57785ae830482080773783ec8696a8715aebc593f942f67b2456da91b057ca0af010dd2ff4545b997613d1e2cd02102a6649fbe8b24d9e7f1411c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7c31f4eac1d44af4c926fc29edb5edee

SHA1
9b3ebb428fca080eb88e2c586ae6f4d8e6b2f62c

SHA256
3ee6e7b5cc84a550f59116a31fb7a1849c5316353f6a2d01935aecc0c460ddda

SHA512
e264e7fa7a276f66a5199df9a1c07be8b935b5488adea0d0be6e51c58c1d0465fbd6a0acc98ffb73d47ba90cb7a4d78e7866e49618bafa03bbd133278ac1a911

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b7e65355b6cd52eff2fd955b453bc71b

SHA1
36206ab3d28a6f6507695f39002ed06a3513c147

SHA256
495612a156177c081c0dddb5eab1913ae090c249eb1a4ce8de414480d71b5869

SHA512
ccc57d499f1bcc8868106c88ead7b0bd937b578c45bb001c4a50e967610befefb902edb1173ce2d67df1eac6fc7482a76260d57f7930cf59f2ac489b9d6b7ddf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bfd139a02320771e1fd2804cb7ce4c10

SHA1
a8c8f1b49842c3d690ec2f7940894219499c35b7

SHA256
ec922e799d8c30e229e8f2a22a6b38c7231251ac63ed53163ef72c50e50f4d25

SHA512
f0e23bd069814ad29bb166ee16b0175c001bcb5fe33464877e6b8bb0466c761caf251517d80b94b67de79a479d697b1569e3ba43ebc7a1d8c3c0985d3aa8bd10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
30b8e31d851b422fa816654a88d93892

SHA1
5ea3267bba10aa81a7c3e44c8c673d48daa94cdc

SHA256
df9d51552b0f5b3447a9d07390a3352b6192fcf5053ceab6c310210fe7d9d55b

SHA512
4e964e8ea722c1697afcf49dd3f624123f694fb984837a607f5ca586ff4f28104d3c25efed17b41c0de5866f1a80c7d05f9ffcc148f79643885fc8bfe628b9f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
4f4871bae077cbfe6edff5400acbad16

SHA1
2790e19828f0d64e1daff40df4a717f301bed10a

SHA256
6100b84ab15f7cdd6fd4ec14edc699a34f693eabb3d85a2045fbe9045e2db34f

SHA512
101e117ee030a0332ec39454283d6bae3e6610e5cb53921d9933d6e399d2a08ba8f468b94078f3523a36975071f81891de55e288e7aa676197235ab0012e67ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5856b6.TMP

Filesize
48B

MD5
1c20e600af3390c0dd3a084cca49fa83

SHA1
791f35501eb41f54d9e77ab114369ad58768b898

SHA256
f613000ff88c26b45bce6f20839f0e2b58dc0008869ce29811e31567ee33cf07

SHA512
0b96da39eec04e246b31f3d283d8976a88d59a5a45c94abd13d19dc99ff42c3672e470bbb86f09ae31957f4cb2f33db45d1ffdcf5e4f3ad7886b8fc4211d0401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
dc813f1f23dc6ea56c9c1f3447711748

SHA1
d78b33e95fdfda5d879c68ade855514642312d34

SHA256
b7b1c613c82c6efe4d2fbfda7eca3551e83bb11d0c169032d7f7d6c3002a4f7a

SHA512
1600f857b74f8df87d298a89bac4d062b97792ee106c29a029ff5aab1fffd9532efeb1af5e35e54b8bcb73abd8db83c730669b553f368205d5d7b1ede5a3b47b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f4396aa442c00e807f7287419319d3e1

SHA1
8a5f91b8c4d1e33ce552b86d26535928965f2bde

SHA256
9c3cbff307a93b04d9579f52148d3be7db0908ab39043e2c0db86b0da72fe4b3

SHA512
22089b4aceaf35d14dad5a8cf91b17ceb146eae6f996c4aebbd3bbd128f23947ac112b4bca53fce0c69ea283953fd722973532d1f6e570685b3725b8b3829a7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a384ad63a549eb6a4684f4d85001e362

SHA1
1bb62972717a92eca761f3c2b38e541b9b4f173f

SHA256
0f621b9c49576ff2fcf25409ee942329ee6206e3b70f2976876e9b0e65ff8cad

SHA512
68b59619241276038e930becb1bc4c1a8d46ccfb4ee0d3e231639a943e328910d51cf4bfcdfb6c29f09bdcd648de42cc314d2256025d6f51a04050d1bd16e4d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe598fd2.TMP

Filesize
203B

MD5
682785980491de756e59c28853b5f963

SHA1
a3f085c19b60f627a3f06272efb9516e9782dd78

SHA256
a5d858d5887d71143559aaf6aec98275ac9eaec708ae8eb5d0918899661a7f87

SHA512
76a71d2ad1b264936d401ed91997e6ec328a863ec02f7dfb4e801241917931ac9c333f71f6bf85e223968067345144faa507bad80c7ee337eb204d3339035c0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7b6a78f45b9b8f378cc42dfa7c809f75

SHA1
a0fe87da1fc781ff3966038a4d8d5d8585b288fd

SHA256
e4b718c71f178015094047144f61b43758f9f24d2db08f9bbb47958a7e5a0cae

SHA512
22c3f1f744f1c9efb3fd6c858d65455041e20377dbb430597256b2529f742d8649eef62e5d22e983cc015e23a6be8bb091bc29a601815d1bd9f585f73b53f143

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ee525ba6396f4985d20fa7878670dbf5

SHA1
41badbd8b31a675db9f9bb1a2251bd0b13620617

SHA256
53343d7cb28e960c67790a8c948159d3c1ac6be1abce30ad38083ecc60feb365

SHA512
669cea51fc79cec3d48c5de1f7c004b7e906c8544ecb664befcf48c43468235abefc37168d30d0c2ffb20240c0011cfca7533286a352184bff83d4d8b86aef37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b61abee94a89f865f52835aa44b2f2a3

SHA1
35e57386a2b396378d828de36c6b5a6968bd7f0b

SHA256
9165ba6757051e148544be098cc51f6503586b6ccd2f5bb7497398bbd5f3301d

SHA512
df46ec3d5ce2ede3dca4b5a67d235708fd501838c0637f3afe2a78642b939d81784bca2f93855aa2468bdcf6a6a931a8a293a23ae838ba3dc9ff2ae5c8415b0e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
aab4621b65eb42b4c5eba81e13b6c909

SHA1
be971bba3a69c86a536441deedf8813980d0542b

SHA256
edd68f48175e151e253c4d7fa99ed6d1ee77b5f2332de2a150a06d745aed5289

SHA512
6b49b50456af9c58dfb8c7e978beb0966f1796fc7c028dfe3e22e1803147e6d972ed8197640c00a95e2a3253d1de0c07bce28f70d95b9af324f080d67ce00054

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
ff4fe505cfe0ce36d6c7626604cb4185

SHA1
847af2c9d481ae7af688b54e4011359715a0804e

SHA256
e4134189599b6a075a7d340d2c8420416c330e96dd3ec3b86b111cca9972e9e7

SHA512
a2516a1eff4dff0d5b5771dbf09f957b72ab064a4e84d366cbdc87dfe2baab1acda2cf75092e82584d3338737274e2ec5574e67ae3c699bdb989639692b16920

Download Submit
C:\Users\Admin\Desktop\nexus.zip

Filesize
369KB

MD5
a9bbfc89690d3095e180b07c6d1e367d

SHA1
e05cfdcb8701c3d9e3840aecdd77516572bc0278

SHA256
a66f58a10ae4cf981749ae70edfbe2759c93eb6eedeaa332c8dfafc3c89e8d53

SHA512
4d8358b3b4ed88db446d819d2e74fed91f51b68f9d9b2d8c63b1e0a1d223b6e044030eb4d5824c1fc8d4cd05ad05c1e684b05623485383d5866593989436d3a9

Download Submit
C:\Users\Admin\Desktop\nexus\Combo.txt

Filesize
1KB

MD5
023182fa42575e5e9d66ff7a2c365600

SHA1
34d3986a5c99168980a23e21ac48316a231d554d

SHA256
3af0d487f24d2b0308e5b8e3261c27131098cfeb8597a20d33e91f5238b987ad

SHA512
9c17e3fcf97fdaa93d4edbe5ab1ef6af0088584dc5e7aacfad2d18a374469a5edb50738d2ed89133ad061fc512ba4ba3ab20b61ee6df8155fb68b43070b6b1c9

Download Submit
C:\Users\Admin\Desktop\nexus\Proxies.txt

Filesize
3KB

MD5
3ef54b3b66608ada63f81b14d9c0274b

SHA1
03f2f01a1cc6adb40f92a76482c4cc47788a1a9c

SHA256
ed60e2c2423d8cff460adae4db811857f3141e7f59cdcc8e5a649faa8f68569c

SHA512
8c24bb681158279df2396291966f7c53ac08170dbed8d47a745f5b5e41f28b476a7805028865a5453386e2bb1fd6693dca205aa3147789c3e261d4b9004fa59e

Download Submit
C:\Users\Admin\Downloads\nexus.zip:Zone.Identifier

Filesize
52B

MD5
dfcb8dc1e74a5f6f8845bcdf1e3dee6c

SHA1
ba515dc430c8634db4900a72e99d76135145d154

SHA256
161510bd3ea26ff17303de536054637ef1de87a9bd6966134e85d47fc4448b67

SHA512
c0eff5861c2df0828f1c1526536ec6a5a2e625a60ab75e7051a54e6575460c3af93d1452e75ca9a2110f38a84696c7e0e1e44fb13daa630ffcdda83db08ff78d

Download Submit
memory/928-1083-0x0000000000AF0000-0x0000000000B06000-memory.dmp

Filesize
88KB

Download
memory/928-1086-0x00000000055E0000-0x0000000005672000-memory.dmp

Filesize
584KB

Download
memory/928-1087-0x0000000005860000-0x00000000058D6000-memory.dmp

Filesize
472KB

Download
memory/928-1088-0x0000000005680000-0x000000000569E000-memory.dmp

Filesize
120KB

Download
memory/928-1085-0x00000000030D0000-0x00000000030EC000-memory.dmp

Filesize
112KB

Download
memory/928-1084-0x0000000003080000-0x00000000030A6000-memory.dmp

Filesize
152KB

Download