hxxps://github[.]com/n1k0fr/Nexus-Recoil/releases/download/v1[.]0[.]4/NexusRecoil-v1[.]0[.]4[.]zip

Analysis

user interaction
yes
max time kernel
142s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/n1k0fr/Nexus-Recoil/releases/download/v1.0.4/NexusRecoil-v1.0.4.zip
Sample260705-seqf6sc13w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1804	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277373753377110"	msedge.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\json_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\൏蠀踀뚅ź	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\json_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\.json	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\.json\ = "json_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\json_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\json_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\json_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{47E9ED7A-CAB3-4789-BC9C-44AC35163452}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\\ = "json_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\൏蠀踀뚅ź\ = "json_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\json_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\json_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\json_auto_file\shell\open	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2848	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4916	NexusRecoil.exe
Token: SeDebugPrivilege	4980	NexusRecoil.exe
Token: SeDebugPrivilege	1960	NexusRecoil.exe
Token: SeDebugPrivilege	2412	taskmgr.exe
Token: SeSystemProfilePrivilege	2412	taskmgr.exe
Token: SeCreateGlobalPrivilege	2412	taskmgr.exe
Token: SeDebugPrivilege	2472	NexusRecoil.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe
2412	taskmgr.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
4916	NexusRecoil.exe
4980	NexusRecoil.exe
1960	NexusRecoil.exe
2472	NexusRecoil.exe
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 1536	4036	msedge.exe	86
PID 4036 wrote to memory of 1804	4036	msedge.exe	87
PID 4036 wrote to memory of 4020	4036	msedge.exe	88
PID 4036 wrote to memory of 4020	4036	msedge.exe	88
PID 4036 wrote to memory of 4020	4036	msedge.exe	88
PID 4036 wrote to memory of 3336	4036	msedge.exe	89
PID 4036 wrote to memory of 3336	4036	msedge.exe	89
PID 4036 wrote to memory of 1728	4036	msedge.exe	91
PID 4036 wrote to memory of 1728	4036	msedge.exe	91
PID 4036 wrote to memory of 1728	4036	msedge.exe	91
PID 4036 wrote to memory of 1140	4036	msedge.exe	90
PID 4036 wrote to memory of 1140	4036	msedge.exe	90
PID 4036 wrote to memory of 1140	4036	msedge.exe	90
PID 4036 wrote to memory of 3332	4036	msedge.exe	93
PID 4036 wrote to memory of 3332	4036	msedge.exe	93
PID 4036 wrote to memory of 3332	4036	msedge.exe	93
PID 4036 wrote to memory of 2756	4036	msedge.exe	94
PID 4036 wrote to memory of 2756	4036	msedge.exe	94
PID 4036 wrote to memory of 2756	4036	msedge.exe	94
PID 4036 wrote to memory of 1124	4036	msedge.exe	99
PID 4036 wrote to memory of 1124	4036	msedge.exe	99
PID 4036 wrote to memory of 3824	4036	msedge.exe	98
PID 4036 wrote to memory of 3824	4036	msedge.exe	98
PID 4036 wrote to memory of 4992	4036	msedge.exe	100
PID 4036 wrote to memory of 4992	4036	msedge.exe	100
PID 4036 wrote to memory of 544	4036	msedge.exe	101
PID 4036 wrote to memory of 544	4036	msedge.exe	101
PID 4036 wrote to memory of 544	4036	msedge.exe	101
PID 4036 wrote to memory of 3572	4036	msedge.exe	102
PID 4036 wrote to memory of 3004	4036	msedge.exe	104
PID 4036 wrote to memory of 2272	4036	msedge.exe	115
PID 4036 wrote to memory of 1880	4036	msedge.exe	116
PID 4036 wrote to memory of 4648	4036	msedge.exe	117
PID 4036 wrote to memory of 1880	4036	msedge.exe	119
PID 4036 wrote to memory of 1880	4036	msedge.exe	119
PID 2848 wrote to memory of 4368	2848	OpenWith.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/n1k0fr/Nexus-Recoil/releases/download/v1.0.4/NexusRecoil-v1.0.4.zip
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffdc880c188,0x7ffdc880c194,0x7ffdc880c1a0
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,7080641726064656328,5515076371719416112,524288 --field-trial-handle=2236,i,14363865109568011441,10876515766735888272,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,4815366035582594795,4293387893812895465,262144 --field-trial-handle=2236,i,14363865109568011441,10876515766735888272,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,6863046495273618698,4136805682644000688,524288 --field-trial-handle=2236,i,14363865109568011441,10876515766735888272,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,1941502054161261169,11231194327214769983,2097152 --field-trial-handle=2236,i,14363865109568011441,10876515766735888272,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,13387175836853903925,11675695718549348640,2097152 --field-trial-handle=2236,i,14363865109568011441,10876515766735888272,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,4838844451345069344,5620598357814187809,2097152 --field-trial-handle=2236,i,14363865109568011441,10876515766735888272,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,6679404833502317408,15770366425249933072,2097152 --field-trial-handle=2236,i,14363865109568011441,10876515766735888272,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,15780122932750109936,16328376023830862645,524288 --field-trial-handle=2236,i,14363865109568011441,10876515766735888272,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,1843647798163508049,5947712340827575062,524288 --field-trial-handle=2236,i,14363865109568011441,10876515766735888272,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,15161301594398199778,14658007663875532306,524288 --field-trial-handle=2236,i,14363865109568011441,10876515766735888272,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5720,i,6031352016990236133,3724138902043857209,2097152 --field-trial-handle=2236,i,14363865109568011441,10876515766735888272,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,11041295745787907852,5670356948711014888,524288 --field-trial-handle=2236,i,14363865109568011441,10876515766735888272,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,7798319624741525113,15641452527101969141,524288 --field-trial-handle=2236,i,14363865109568011441,10876515766735888272,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,7798319624741525113,15641452527101969141,524288 --field-trial-handle=2236,i,14363865109568011441,10876515766735888272,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,2117521872090297533,2458207524261881246,524288 --field-trial-handle=2236,i,14363865109568011441,10876515766735888272,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,16638318611522197118,8177901417132525423,524288 --field-trial-handle=2236,i,14363865109568011441,10876515766735888272,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,10766669137508288043,2612442885962290539,524288 --field-trial-handle=2236,i,14363865109568011441,10876515766735888272,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,17361551501086165526,12193470884077572357,524288 --field-trial-handle=2236,i,14363865109568011441,10876515766735888272,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:1880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1740

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4320

C:\Users\Admin\Downloads\NexusRecoil-v1.0.4\NexusRecoil-v1.0.4\NexusRecoil.exe
"C:\Users\Admin\Downloads\NexusRecoil-v1.0.4\NexusRecoil-v1.0.4\NexusRecoil.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4916

C:\Users\Admin\Downloads\NexusRecoil-v1.0.4\NexusRecoil-v1.0.4\NexusRecoil.exe
"C:\Users\Admin\Downloads\NexusRecoil-v1.0.4\NexusRecoil-v1.0.4\NexusRecoil.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4980

C:\Users\Admin\Downloads\NexusRecoil-v1.0.4\NexusRecoil-v1.0.4\NexusRecoil.exe
"C:\Users\Admin\Downloads\NexusRecoil-v1.0.4\NexusRecoil-v1.0.4\NexusRecoil.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1960

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2412

C:\Users\Admin\Downloads\NexusRecoil-v1.0.4\NexusRecoil-v1.0.4\NexusRecoil.exe
"C:\Users\Admin\Downloads\NexusRecoil-v1.0.4\NexusRecoil-v1.0.4\NexusRecoil.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2472

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\NexusRecoil-v1.0.4\NexusRecoil-v1.0.4\settings.json
  2⤵
  PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 758df8d3fcc8153add0884f31eebee2a2577adda6817b51a21944c2f22794229
MD5 dfe64ea383e58df01fbdd8c6865b3a83
SHA1 64d0ff086bd183d34c0b6b57979d47d1fe496dd7
SHA512 524a90cba89216a298c0432d24ac36c2e9c4be3586290c83a8e424408da052cee2b563929aeda73dc89ea7e7dbb596e97fee811e69b8a48e16ebaa5a39d7063e
TLSH
T1BFD0A73076696C96D538147194314701BEA58556219A96066144840D5C796C2B68A5A2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 2.0MB
SHA256 0d04eba2f8e804482bc589f6fe9ea489e2780fbb500dbdc47fb8b3b2ff7c9032
MD5 803890c33bcf891efe908cfbc0d9199b
SHA1 a82fb177f80056a1f5a4184a3fc6781bc4704a9c
SHA512 75b5d04c16a2997340aea2c151ce9e53d5ff9da13c20e6385fd9c2f080cdac8939af48db8fc069a45b2479ced35775f8a46b4ff9290a20b0cb1826208a035fcc
SSDEEP 49152:hkO6lJDUzyfM/OyQbo0YhMctWfjqE5rj+RAx4a0Aq6w:UDU+fvo0FZjdrj+RA6ax3w
TLSH
T1D9A5335DF3EDB7D3A094C72B3216E5D6D2E54843B2DE44A66C226C2135DA33BAF20718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b826ae80476d74bbaa7e206e7d4e8b4358f436c3c89fc31c3bff64e13412dfb6
MD5 61362bf45f375f5f569c7e6d0b64279e
SHA1 1bec1650f3768cbaec78babaa7b6851ff4736cd3
SHA512 8500f25e46f89cdf3950661bbce5b0c58afe6ad8c3832f9a4528fb2b9aa0a233f086649d9e6490b3912cc85c95a55a4115e57432d427c26e21699519dbefce40
TLSH
T1C6613A850B62F46AEBEB31B0F0DA03077D31809A06775ED6028C8D7D690DB15FD657A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a8af.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a8af.TMP
Size 3KB
SHA256 96054bf18be25a1f3c167f1db078cc1f80774c427be55a1c7f6a4d91472db07d
MD5 295d0203089eed2200e7310bb34501b7
SHA1 6e8b0973698f521fa42583c5168cbfc77df2b681
SHA512 f8acffcb453c10ecb070caac26aeffe77fde825577ecc550f0647ac63f60c02d779eb60aa8b19e21c5f716847078baaa8a2c714c01357601abaace122174d5dc
TLSH
T1A0613B850B62F469EBEB31B0F0DA03077D31809A06775FD6028C8D7D590DB15FD657A8
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 1234ed08168dcdb49dbcd07b00b38ac0d491643dea145f640d63a6c24ce9a1e8
MD5 92464a9ec45de61957cb6b321b6b5499
SHA1 ec0e3a9f8fea766e874806e97ed2a5e15b45e78b
SHA512 41351ae533e78522433bcd2a04351188b2a43ca8d812d13e7bf2f7c9093fca8d9d5ed2b048718a01f7be37e3b1e4448e9d9edcb9d7cab0c52e8dc5441dc0cff9
SSDEEP 3:MsEllllkEthXllkl2zE/le:/M/xT02zh
TLSH
T19A4404147FC05407C740113040D3C3501370D43007137743345105737CC77400C00010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7a906ab2fc8573ed1519904809e311f4632f44cffafa23d513c18594e7454794
MD5 a23287314c2b144f1ad7688a2786c149
SHA1 c709cf43942e453e59bf1ec1ce2fd8068a177d57
SHA512 498cb96118cf8f0adc613cb851dab9f1b858d2336597401a499110af7710647d7d35ed5eb4e49299cba66112843f66657cb8a33c355fce3d65a74216c0524215
TLSH
T16021D2F783E5856E8A0156F0AA18AE2BCE2D0515831C7C1985E4BF17D3F3475E002A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 490fe0d41d573c08761babfe13c2805a1a6aa4477a867e7385a82a8d971bfdd0
MD5 9a7d6102ede00f297489e3276b0f56e2
SHA1 f5c080d87a58c2dbd425c2d98a2beacc3689ab56
SHA512 9f187e89f18509d8a971de0cd551f34e90d73324439320ce342e840f1f043ed5be48dd0a27d002f54d2ffb03d44af7d84cd32f15fb2654729152e6125794dea4
SSDEEP 192:sxZfRNyM/jK1Ml8M9O/ffsIgJrIdpJHW6+WNGYw821FIgrJ:sxZfp1O/ffsIy0JHbGL9
TLSH
T16642D912AB349A77CCCBD209F955BF53D6F94472A2900D44A9FCCA0C05E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 19bebcea336745621330a137540f9c6ff0d0631fc44dc5a4f7816a31a04fccfa
MD5 51edb0cb355613e20aa4fb55bdee5ada
SHA1 5dfbdd3d4c960177152203b94a2ce23a95f5786e
SHA512 86299572d41ab28780052439b4f7c1e621c18b1edce7e5fb0a6d3d8a7c03912de61c9f3af8849bf6b030091593829b100fad96913be6f10d11bf4f7095183643
SSDEEP 192:sxZfRNyM/jK1Ml8C9O/ffs0WpVjgdrIdpLHW6+WNGYwQe1LIgbUJ:sxZfpxO/ffs0Wvji0LHbGv8
TLSH
T12352C816AA389A77CCDBD209FA557F53D6F91432A2500E4499FCCA0C05E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5cc178c915b9d606ee13759d05ed63c7d01b7a090d79ce9d32d12161b887432f
MD5 76a1e6c271d40f6a34107c81207566b4
SHA1 94daf731a9ea72e6d88b2f8c2b2355c02567c0c0
SHA512 64e69d36f6c8fb09b96d9da0b2e4b118a653c1fa0c0312b427a67b4f2999bbd20f8e9faffa017597b85bb4f1bcdca72f770454f069abb269722984a0ec0abee0
SSDEEP 768:6X4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dFrohOcLaM:6X4jeXmWvmKLEu1jacPLZQd+Pj
TLSH
T157D20A3B280CCF7E4F844E5CED2AAE976ED801CB6A584D5447FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 07a400a238546a41f7f363ea13ed72d0eb95c63b557821139eb19ebb6e010cae
MD5 056fb5ee10b13c051c1e7d4170061403
SHA1 0a70cbb4d80e2a040bf72a7dd417a07786e6ca1b
SHA512 8c2f5e4b823a46f1af151e38d1158ee0118dd1bbdeb831129d683204cfc8eb8f434f7680b50700d35194a55f55721d44bc1868d2a281694ecf417d6acdc8b354
SSDEEP 96:KQpqKikaubaKEcA9KD3tHbPWDYGg/PK4eghPcF9wTrEHxOf7Js:odRD9KD3tHbuDY3/1eghEF9wTrEHxOfq
TLSH
T1F5912F13327F1207693E2A0C9369CA176785B5A33058A52B37AD40610FA7E359EFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c0e0564-fe72-4366-a77d-511a466dfe37.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4c0e0564-fe72-4366-a77d-511a466dfe37.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0ee38e7cca6ffc74b57e2907226196f5205c092e807524ef4c7921257280e89d
MD5 65420e07ee87f5e2244fb2d8521a21c8
SHA1 b3ede62bf1d87a7f3c4b4f479ff8533dccacd3f3
SHA512 c83005fd3e3c30011765c6091748267ab1f2bd713db1b42b7abef7a7d666d8fd0a76014a126c274d0d88429115abc3944680048e6e2433f5adedddeddae49262
SSDEEP 384:ctNn/s3n9STsNNxJazbMLEnf++OWYXN+2mFFOObjI9G6w7W:cj+98YacLEfHOVNlYF29MW
TLSH
T1A4927B32A828DE774CE3D659F0872A178FF8816B96C52F88D1EC6F0C05CB7AC130A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c4cfb6dba019909ee3939acc4e8c8239a6eed43d0ec818d4c81138dcbb727322
MD5 2495eb52053e3fbe8ff407dabf6f034c
SHA1 cccb95a7031ce78e2d75249b44ada1d243b1801e
SHA512 a95c56861e18a93bbb744dc31f8a545d5cdbc53c52ccd1a4aa9c8d5aa084d8eaac39cc75b2fba5156e78e2bc0cf06e24c6e27f2acb6e712a3aa3eaf4f83a0069
SSDEEP 768:UFtj+9ffwg6awFwfHOVNlLB2d68P2qto29MW:N9fssyJI9dto2+W
TLSH
T14ED25B32D8988EFB4891DAC8B546A5179EF4417BC5895A8CE2F87A39309F6FC4346C50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4575af50e7706e86863ec827e461e5e298b2fdd9800ab198319bd6410e0355f7
MD5 ddfdecc57ffc60a50e70365e42e3e127
SHA1 b731c2407bcce856817dbcc481d9fa0aa1140446
SHA512 66744a17df8fbedb1cdf8f859aad21066129f09a4df2d820743972ec5872e84523d39bc5b5440d62941e816da33aec7c4c396d051e29d14b9184ffce5c099ee1
SSDEEP 192:EON06hZ0QmiUyOGOIpc/+jV4O1cYa5wOZrpU6:EON06o1xIpu++OWYh29U6
TLSH
T19302C835686C6C778EF2AE45F48777235FE4112BA9956F84DAE81B1D00C779C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 88122575f288faf4f2b53c5645707a9a7581650c6c577b4b8682b43c7bdb3353
MD5 dbeb68c9e2dfba7355a6e07a3e2910a4
SHA1 97bfa8833ece18dc93f4c06433f0e82cfaf5127a
SHA512 78628536e34a2d8e7de657d7c950689d6ccc5e6cef8fb308317a11a1c213487ae3655d958b42f5e1da078eb0a98fb5094bc17a0850d0e619cd26a687d1c729cc
SSDEEP 192:5ONY6hZ4QmiUyO9OIVc/+jV4O1cYXN+245cOqCqFU6:5ONY6k1sIVu++OWYXN+2j9FU6
TLSH
T1EA12F932A868EC774DE2A655F48736138EE95127EAC57FC5E5DC2F1C04DB7AC230A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 aa983bfdfad47ac1849ba41467fc3d9e7f0b22cad3a9530914d87ae7617a0c43
MD5 2975b4f31603f106fc39bcdd0163712f
SHA1 880cd5a0d4fb106c1feab6232aa6dc9f436f115e
SHA512 54a45b3995e8c387a6128f408c5253d37b0575a2e9da3d1aaf6065f6133433c3c28dcf287369ced26f272bf95f24f7e3f616b928807ef7a5e10f0fbcdc699197
SSDEEP 384:p3iFAtNn/s3n9SUHsNX8TUNTUlIloJazbMLEnf++OWYXN+2qFFOObjI9G6w7W:UFAj+9f2wg6acLEfHOVNlcF29MW
TLSH
T17CA25B335858CE7B9DA69A99F54B36178FF851ABC6C56E84E2DC6F0C01DB2EC030AD11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4dade911e1fbb8322cbc2431b03ab8716a3c85aa9b8fdf5b3a3d920defd65e59
MD5 ecc6474c3036e9900924255d8eedb0a0
SHA1 f1feae1100af3bf6618b33ebe31767364dfbff85
SHA512 2c689b992e9e3bc25c9b92d5638c87b43e5887fb5bfa5ad407fa3592f38ef59b0ee44608c2176a5b71b53dceef66acd9a75db7199461ba1f7eb7c935cda96791
SSDEEP 384:hTtNn/s3n9STsNNoJazbMLEnf++OWYXN+2mFFOObjI9G6w7W:Rj+989acLEfHOVNlYF29MW
TLSH
T142927B326828DE774CE3D659F0872A178FF8956B96C52F88D1EC6F0D05CB7AC130A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5682c85c-9206-401b-9d8b-c94f42ddec47.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5682c85c-9206-401b-9d8b-c94f42ddec47.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 50b434421686a1a0bead16ed9d54824d12f512a4ee8d2dc9d31e00c39c70570e
MD5 6ec0e9ab8a566c9962e4e9779e3ac653
SHA1 961ea9c4ff6e3c5c11f740bc618a6bf430d60dcf
SHA512 0284dff9ad0c07030d2356ceddbb78cde8853b89bfaf0c09813f830535ed34eb876bb8e3238d7c28380b7d6d8c8484229bb946f1f45818fe3cedd1507da6f9e6
TLSH
T1BB410B58AAFA1144B3B76F5A9BF6686D487EBC772F0AD05D10010E4F0627B40C861B77
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\Downloads\NexusRecoil-v1.0.4\NexusRecoil-v1.0.4\settings.json
Size 963B
SHA256 8db13867ef64c5246893eaddca1579ad33b019de83b32cc76a5faf22d34771ee
MD5 672c4acd031e610a0475c1a5773f5bbe
SHA1 f4268af51aaa410ae9d94d802617ecc43a17507d
SHA512 a6834f4ee9577d6c8f1b467d4dff08bc302631080a1fd6253189e997d4b1cc18d7cf9285029db917a926be99145b65c3baa5bd02d8d8cc10d88704c7cbeda784
TLSH
T14C11CE2AC81420FE597CD1798535522B43559F4D22791C3FF7FB8C4C7A5B6362206FA2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2412-420-0x000001853E8A0000-0x000001853E8A1000-memory.dmp

Download

memory/2412-419-0x000001853E8A0000-0x000001853E8A1000-memory.dmp

Download

memory/2412-418-0x000001853E8A0000-0x000001853E8A1000-memory.dmp

Download

memory/2412-424-0x000001853E8A0000-0x000001853E8A1000-memory.dmp

Download

memory/2412-430-0x000001853E8A0000-0x000001853E8A1000-memory.dmp

Download

memory/2412-429-0x000001853E8A0000-0x000001853E8A1000-memory.dmp

Download

memory/2412-428-0x000001853E8A0000-0x000001853E8A1000-memory.dmp

Download

memory/2412-427-0x000001853E8A0000-0x000001853E8A1000-memory.dmp

Download

memory/2412-426-0x000001853E8A0000-0x000001853E8A1000-memory.dmp

Download

memory/2412-425-0x000001853E8A0000-0x000001853E8A1000-memory.dmp

Download