69e915cb4fef0647358728d44837a8d53f09dc5b5a083f660ac78c3c825ef6b8

Analysis

user interaction
yes
max time kernel
43s
max time network
42s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nexomia.exe
Size 14.1MB
Sample260730-tbwpfscp6s
SHA256 69e915cb4fef0647358728d44837a8d53f09dc5b5a083f660ac78c3c825ef6b8
MD5 93905e5675e7c499b6d2b24e68b201e0
SHA1 3cb888350a0a010271061e7ebcac15f127678f07
SHA512 d62152cf5b9ec157e8308e873ccaeb2504f2dda6c7b9578767cdaa3b040fa8674fde40036776c34e05aece990a4d190ce0e70276348f1eee7fe0ca3d319f4da5
SSDEEP 196608:bFaMVsfMaf7R5KnfNgGLm2TMU/2zFKbPofqbvsZKW4:JaMVyBH6NgGH+zqPnbvsZK
TLSH
T1B4E69C43F66280F8C16AC075935A6232FA327C4947347AEB5BE08B253E65FD06B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3696	Nexomia.exe
4516	luau-lsp.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Nexomia.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Nexomia.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
5944	tasklist.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4848	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
832	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2864	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4876	Nexomia.exe
4876	Nexomia.exe
4876	Nexomia.exe
4876	Nexomia.exe
4876	Nexomia.exe
4876	Nexomia.exe
4876	Nexomia.exe
4876	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe
3696	Nexomia.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1328	msedgewebview2.exe
252	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	5944	tasklist.exe
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeIncreaseQuotaPrivilege	4848	powershell.exe
Token: SeSecurityPrivilege	4848	powershell.exe
Token: SeTakeOwnershipPrivilege	4848	powershell.exe
Token: SeLoadDriverPrivilege	4848	powershell.exe
Token: SeSystemProfilePrivilege	4848	powershell.exe
Token: SeSystemtimePrivilege	4848	powershell.exe
Token: SeProfSingleProcessPrivilege	4848	powershell.exe
Token: SeIncBasePriorityPrivilege	4848	powershell.exe
Token: SeCreatePagefilePrivilege	4848	powershell.exe
Token: SeBackupPrivilege	4848	powershell.exe
Token: SeRestorePrivilege	4848	powershell.exe
Token: SeShutdownPrivilege	4848	powershell.exe
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeSystemEnvironmentPrivilege	4848	powershell.exe
Token: SeRemoteShutdownPrivilege	4848	powershell.exe
Token: SeUndockPrivilege	4848	powershell.exe
Token: SeManageVolumePrivilege	4848	powershell.exe
Token: 33	4848	powershell.exe
Token: 34	4848	powershell.exe
Token: 35	4848	powershell.exe
Token: 36	4848	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4876	Nexomia.exe
3696	Nexomia.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 1328	4876	Nexomia.exe	89
PID 1328 wrote to memory of 3820	1328	msedgewebview2.exe	90
PID 1328 wrote to memory of 3276	1328	msedgewebview2.exe	91
PID 1328 wrote to memory of 3276	1328	msedgewebview2.exe	91
PID 1328 wrote to memory of 3276	1328	msedgewebview2.exe	91
PID 1328 wrote to memory of 3276	1328	msedgewebview2.exe	91
PID 1328 wrote to memory of 932	1328	msedgewebview2.exe	92
PID 1328 wrote to memory of 2696	1328	msedgewebview2.exe	93
PID 1328 wrote to memory of 2696	1328	msedgewebview2.exe	93
PID 1328 wrote to memory of 2696	1328	msedgewebview2.exe	93
PID 1328 wrote to memory of 2892	1328	msedgewebview2.exe	94
PID 1328 wrote to memory of 2892	1328	msedgewebview2.exe	94
PID 1328 wrote to memory of 2892	1328	msedgewebview2.exe	94
PID 1328 wrote to memory of 2892	1328	msedgewebview2.exe	94
PID 1328 wrote to memory of 2892	1328	msedgewebview2.exe	94
PID 4876 wrote to memory of 832	4876	Nexomia.exe	95
PID 832 wrote to memory of 5944	832	cmd.exe	97
PID 832 wrote to memory of 5368	832	cmd.exe	98
PID 832 wrote to memory of 3696	832	cmd.exe	100
PID 832 wrote to memory of 2864	832	cmd.exe	101
PID 3696 wrote to memory of 252	3696	Nexomia.exe	102
PID 252 wrote to memory of 3044	252	msedgewebview2.exe	103
PID 252 wrote to memory of 3456	252	msedgewebview2.exe	104
PID 252 wrote to memory of 3456	252	msedgewebview2.exe	104
PID 252 wrote to memory of 3456	252	msedgewebview2.exe	104
PID 252 wrote to memory of 3456	252	msedgewebview2.exe	104
PID 252 wrote to memory of 6048	252	msedgewebview2.exe	105
PID 252 wrote to memory of 3676	252	msedgewebview2.exe	106
PID 252 wrote to memory of 3676	252	msedgewebview2.exe	106
PID 252 wrote to memory of 3676	252	msedgewebview2.exe	106
PID 252 wrote to memory of 4320	252	msedgewebview2.exe	107
PID 252 wrote to memory of 4320	252	msedgewebview2.exe	107
PID 252 wrote to memory of 4320	252	msedgewebview2.exe	107
PID 252 wrote to memory of 4320	252	msedgewebview2.exe	107
PID 252 wrote to memory of 4320	252	msedgewebview2.exe	107
PID 3696 wrote to memory of 4516	3696	Nexomia.exe	108
PID 3696 wrote to memory of 4848	3696	Nexomia.exe	110

C:\Users\Admin\AppData\Local\Temp\Nexomia.exe
"C:\Users\Admin\AppData\Local\Temp\Nexomia.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia.exe --webview-exe-version=0.0.6 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4876.3344.14480757243610744188 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffcf5875fd8,0x7ffcf5875fe4,0x7ffcf5875ff0
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1724 --field-trial-handle=1728,i,14916244120678539406,11161884497815203396,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1940 --field-trial-handle=1728,i,14916244120678539406,11161884497815203396,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:932
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2408 --field-trial-handle=1728,i,14916244120678539406,11161884497815203396,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:2696
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3420 --field-trial-handle=1728,i,14916244120678539406,11161884497815203396,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 /prefetch:1
    3⤵
    PID:2892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Nexomia\update.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Nexomia.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5944
- - C:\Windows\system32\find.exe
    find /I "Nexomia.exe"
    3⤵
    PID:5368
- - C:\Users\Admin\AppData\Local\Temp\Nexomia.exe
    "C:\Users\Admin\AppData\Local\Temp\Nexomia.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3696
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.3 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3696.244.4269798863171111150 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:252
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1c8,0x7ffcf5875fd8,0x7ffcf5875fe4,0x7ffcf5875ff0
        5⤵
        
        PID:3044
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1796 --field-trial-handle=1800,i,8659456394761342313,3576766670936329741,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:3456
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2036 --field-trial-handle=1800,i,8659456394761342313,3576766670936329741,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:6048
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2640 --field-trial-handle=1800,i,8659456394761342313,3576766670936329741,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:3676
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3572 --field-trial-handle=1800,i,8659456394761342313,3576766670936329741,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 /prefetch:1
        5⤵
        
        PID:4320
  - - C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe
      "C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe" lsp
      4⤵
      Executes dropped EXE
      PID:4516
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath | Where-Object { $_ -ne $null } | ForEach-Object { $_.ToString().TrimEnd('\') }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4848
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Nexomia.exe

Path C:\Users\Admin\AppData\Local\Temp\Nexomia\Nexomia.exe
Size 16.5MB
SHA256 ac2351d21649bbe92bb010d83df9b2ae3b9e07aab14f7ed208e8345876d9c5cf
MD5 8c28d6221241184064be6cf45b9707ee
SHA1 c54be190f2d482c54089697418fd90753c21f106
SHA512 8dd2ec51bdf2b3aea2d6a0606f3153163e547ee0b6244fa3296e43b77f3976b25652909769e5b39c8bd44c125da551069fe0fd49f83e016e77f4228313a217ab
SSDEEP 393216:0KY1xuBpIHz8qBESLKKzCkv6QBYPCggSbA:0KCxuBo8qBcY1v6AYqEb
TLSH
T18307AD43F66280F8C16AC075835A6232FB31BC4907357AEB5BE44A253E66FD06B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.bat

Path C:\Users\Admin\AppData\Local\Temp\Nexomia\update.bat
Size 532B
SHA256 ed38812e0842092c5151a9a3f764a3d6a211aa667e20e69c0e51173b14fc2a32
MD5 179a1a9d55c426b7d0e6d3a01f72f514
SHA1 7de19f747badcdff65627c4dd6cac5a3341ccd59
SHA512 f6c584ae77a464408806528ff73b341f18766c7664c57df37acbbd50eaf295da4eaa51776ae49f945dcc4160f69ebe56736db16b4910ecf95e35f717be93f23c
TLSH
T123F05038891A06B500645A99CF5E3544D5FEDA4FA79D7AC014C0D68D366F18A1E873C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6054397b25fbd4329c83d6cb5c97aa632d157e7a28523cf3d68643d8175fa11e
MD5 cdf99ef00eeac17cc24e3d573c1e1179
SHA1 2bc6126899c3a72e59edf8144c48e9a23a427e2e
SHA512 b912bccdde8396b813f58568e0e2050abcf9010f06eba8684b45423b77fed0bd2a38ce07192390aa0ea999d627c36980c8f3d2507fc7fc9008d198bf5b7fc0d9
TLSH
T18BD0121277024138C02060330043714C4440E61B41194009A43DC59D5A6A0588906891
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 aa88bb64c678983b03d87f1d089486ff9da5fc9cf509a706a452afe94e884335
MD5 97b404c56132e1c6064e4ad3308c8889
SHA1 7d70a84e0a9de85bcfbf284a16935a2ad5b2e825
SHA512 37f9866e6f5b84c8f915afdd7c09779ff17bbf7ec608b05c538dc981f9487b92071b303920336f082e0d37ead06baae49be4b40d79637461a9f71f25605cc6d7
TLSH
T176D012127B024138C02061330003714C4540E51A42194109A43DC5AD5E6B058C906891
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 93c6bc2f0440a0bdb7b5197d7818746add303be662af0aa6a00dad102b3a60e9
MD5 ad1a026eef047ab97734074a305ac332
SHA1 7e8f64e85c8a5c4a4eec64dc654e10a7337bbb2d
SHA512 d02e517727fd7eb4ed5fa1a8389671e3ef13ff3a6a52b7398731732c7c0131f942aa60b08846985f75dae09e50722d7c8190b975cff6ccf316893cc3adb1cf19
TLSH
T18AD00450D7014014C055D03300535144C140FD501535150D513540C444F700DC005450
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 8c5b333cfd0aa1d9d4f1111be5eb2ad617c445fbb059c93865bb4498842e6799
MD5 db03f3f1811cb3c0fb1d0cf2a91bf731
SHA1 d521dfebf727c676f505bcdeef4e05d3d2dafb30
SHA512 db853860345bc92a07cdb6c19ac6c2cadfd4f06553e7d7e15144f7ed1172822eae19d8482b0e0f2b278ca8a1780059f96bd162dd1a8080c6906e2041f5937b7c
SSDEEP 3:MsFlthltlluhJ4oH/1S/+fl7Ht0TKlDKlHE6wwQJTKDc5nVohSJGJ+flqfil1:/F8hdHnNxqqbrjdKDc5nVoEJA+IK
TLSH
T12B138CFCE5D11E14C1C5203EC0C3E3302BB09808DC8B439331207832B085F09422C300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 a446e307464d8d7ffe5d39aa3e93bd71e91cb31a78ed9c5367fddc61a90e4b0e
MD5 6e0dd06978cd66f40bf2e4ddca4adaf2
SHA1 33594d60b01aaf436ebd7de775d639c586d58285
SHA512 2cdf10d960b023f3e157011c431c47892ae4aa3dc490e907ec64a3ff4fb79e31f756ab6c14f636aa6170c9cda45a8b8ecc571ca8c23b2b5d545e42d5bf4f9a8a
SSDEEP 3:MsFlthltlluT43YG8kflqAP4YLfKlf1VMRtKZdu1S5u3K9Kl9TKlEC+fl4J2:/F8T43YPkNq8LfbRtKZdV9qTLC+a
TLSH
T1A11302AEA5911D9AD5D8547D82C7A6B153728C448D96066731B46823B085B95444A601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 e9dea04838a92ede45c00894adddedc99f939c333b93351e77541a7e6caf2011
MD5 91da05413bc83a73bb32f43816348073
SHA1 b46614b7abae77814251785bf8598b3815134505
SHA512 7277ff64e9455883f937f833464e1fe0c1151cb3aa7640110319393645ba615adbc769c00838925f222170450db4fea5116d5f03cabb6d1c73f9abfb5ad52b87
SSDEEP 12:U/9/I2HXkkEWn9kTGLBDDSOv9kTG68y8Shhy1Z9kTGLApb2tIh9kLRLCo:Gk9GLByG6MaGLApblG
TLSH
T1884448CE4F05E401CBB85AF6AABDE93D866711D819ECA742FDA048008DD27DE2DA075C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 c117283dbf65cc28ed30b73afb5af16bff17a53e6b17ed047e77d760822c9757
MD5 866bf4a53cacf1f6c9fd3e8d1ba76a2f
SHA1 99cdf419f259f1526314edb760ed4353fd387177
SHA512 36ed05b9404a897e156c6e49c68e7598d60f39b61b5da3b08892f8f1042e64a3128e3a2a341bf28b529eb1cc562d735639cd6201dd43bba3f56e82f7dfe15c43
SSDEEP 12:U/9/I2Bkknh/jpWI9kTGLBDD1xJ9kTG68y8ShAVy1xJU9kTGLApLY49kLRLCo:GnV6GLBjqG6PxJXGLAp0r
TLSH
T1074480CE4F05E006D7785AF7A6BDE83D876751D418D8B741BD9048006DD279E3C9071C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 8a8d5ee6e91d5f36c962babe92ab554c6f4f60548d0ef3c23c7e57f1b475eb99
MD5 b30f13596670e48d113bd85ed810b23e
SHA1 16ab1e00dfa9e756618cf6153317e413633213d7
SHA512 ab22beb281bcacc1b138ce803c0e4e67acad2626b244548b4529f72a3ff1c219bb5a73a1fc13ef461d8c98a4890451d96a5b397a873ea7c8de1fd0c7a09217e2
SSDEEP 192:oDkcpan9b+FqtdNWan9b+Fqt53Nan9b+Fqt:owcon9b+Fmn9b+Fhn9b+F
TLSH
T1A425F9D91F34AAA2DBE2ED70BAE6C45A3EF41085AFD6F0535546C63500C3BC60E5528F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 5a8c504d13d4a44990799a5e920e6a383c5cf43171b8434c6b9488c00a2e5c76
MD5 0ce9b7fad4431d69102e68ef9cd20520
SHA1 4bb6e5fd7bcab35f9833477faeb29177111deb23
SHA512 7be902aa4170e2e1d16cb6595916a960a9efc14be02bb77729182ec93473511ff7f43a0be2fff591485c98d2ef56fab07d0872043e7fb8594d44f96cef797d58
SSDEEP 384:O3q7luI8OC4PygPH+2p1ZOrhlfVClTv0MVQ85OsENnTDi:OeEmZ+3fWT8MjsNnTD
TLSH
T10416C0CB272E3821FF970EF03DA4F7265530BD68B1A183E48842256997C13D18B6D76D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\f_000001
Size 17KB
SHA256 aa62be4b0740c463cef75abbc29482e33ab9c91c75d8aedabe63264cadcc4d12
MD5 d332bb6ee1ab608975ee5f769b6fc4e5
SHA1 1dd7f35cf3da01f6409d011179b41c43925cae6b
SHA512 572a6a8886f97e848fde95285d81137cbd32fba1501566a5d2e95c34a2684cb17b21be75b91d6bac5da0313fba3406f7c835c0d45afab676c3e995f3011da79f
SSDEEP 384:6Y9YCcLTuYTNqgOpRdzVDEhf8yUK5lL7CuiIrXWNn2Ut:68YCaTNqgOTXDWLv5FfX+d
TLSH
T11382E19D68A599E0E0548716B217EBEE03770EC15F13940080E4EDB787475FDAB1F828
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\f_000002
Size 31KB
SHA256 28af44cd3766699962d197f103d31ba2e1bf48f4eb942ed1283755167dcd4c30
MD5 26e562fc6595c461cead42c79310e4cd
SHA1 f31f15822a1cbcb6d4d26d14a5a21d1334ce5f0d
SHA512 626f750f7876c741aec07b40035c3dc21584b2cb080ff398a610ba1176c42a1b02cdfcc9dd4d2d9143aaf3df8a5b4accb2ad4d261ed3ea2c20f7193f23b8a511
SSDEEP 768:0SHPcUru0CvXdkb3DYST0+YRQVcewqHa19iVy:0SHPcX0Cv4cST0+YRQ53Ha19z
TLSH
T129E2F1EA1390F5BB374EA2161226C4BC91C11F9E2DB7B72E8BB31B54B07140225395A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\f_000003
Size 85KB
SHA256 2ba397a357b556335c6ddd6d5ec442f1e49c53687fe957fab4743490f2589430
MD5 16208805a5fe139b1209c570acfcfabe
SHA1 1d114557b8289ac4da11ee4e745e723d74282714
SHA512 8f638b42d32a31ce9f6aa26647d26a0f13b9db36ce09a3a420db791bc17a4afc2d8839c34b5ecaf06c21e48d826106e9abef1e77acacdefd267706e7c6210b01
SSDEEP 1536:qCyFzZmrEND1Pl+7gpMCKODBPm/FK+Jr5JCl5vJHZ6XTms8263OYZFXA5tdiP:bYmgND1t5pmOD10FKETo5vdSTmsxBY7t
TLSH
T1168302BB54FA567299E7F052D217CB0F85AE39C081980532CB67BABDC91B98D16708CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 5844e5f3cf4fcf2e688dc720a895f091b07abefedf503acbf3e0ecf954657871
MD5 c9e52aab54e674b96665669d1b0fb5cc
SHA1 3227aff8e1b0784a5af2d2668a031006d3199906
SHA512 99c79010a8168b8658dfa5bcc99d265334e5c9a238f109cee37125a5fe370e804962933826f0488281977f87d370e7ad180687ba0bf6cab6b8d25c20ce16aa0a
SSDEEP 3:LsYllNlNllkll/lw/Rll8911PlXl5NtlmNtlAl:Lse3lEtVkN
TLSH
T10344016A97D24C0AC5D0467E888783242764C648CA0BC3471398693429C2BA01E0D040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

026627956d140edc_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\026627956d140edc_0
Size 275B
SHA256 0437f087d7a04b3d4a2512b3893da96b716524df5f91c3e224c01cddb9883119
MD5 41ed2f6bb9338ec44043c7550a59cffc
SHA1 958e85f20238a6e18998c2cb36612c06a8b2cb1a
SHA512 ad9cb616f81fa00c6cfde1d2e380446fbb908668164c4566ac9af4b037f1ba1e4f5500d4988b354ff789c1224666dec1db75bff6e1b332a1ca8c2964d9b6ac81
TLSH
T1ADD02BCF4B25F506C66CC8F8CBB9CBAB530544B000588012214CE4D2058275D3715604
MD5 SHA1 SHA512 TLSH

Submit Download

09f4703a13aac448_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\09f4703a13aac448_0
Size 258B
SHA256 9b3eec0898bf8c7f13d95206036fe2a8ab4d19e1f12e0f93f118eea298c05522
MD5 2c2c26eb3c4db3e5f88eec73eacf3f6f
SHA1 81434693ff2ae0698abbf3c022cdc51bde9d92eb
SHA512 501054279bd3816df3aa05cd3c5082bb39828fbac9e5c1427c6d42df7ec7fac9bc3ec0bf616dfb7a0b32e1913642cb0dc91e7640a3c91d2a8cf90f4cff7c796d
TLSH
T185D0A78FC5628188C75D95F1DBD58D0E975F90F8159A88419016ED52A3C16793534351
MD5 SHA1 SHA512 TLSH

Submit Download

0bb68c39f8bad1bf_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\0bb68c39f8bad1bf_0
Size 279B
SHA256 886d46b2f4b1467e32deb0d7312f886377ac98d98088fffd7fd8f036e74b1e86
MD5 5ff931a13562cdc01c915d6a13236578
SHA1 973031235038be9859775a83e6ad8f3ce265fbb5
SHA512 5beae7b5b7b7e97e83190f0515f2336ebc6c235c3fcfda2f8c7cd25f351742a073a7c283fbae57f433d473002f73c01bff33b8c59ed01141b2fff3847b02c617
TLSH
T1C4D0955F8559B946C254C5F8D7F5CB754725C0F405669411210CDCD780D05347752120
MD5 SHA1 SHA512 TLSH

Submit Download

0bc561a46ac06d68_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\0bc561a46ac06d68_0
Size 280B
SHA256 4c83973a378c0d3a4700cd5b9a28148038027bea5245659f40a1c8e215bb7cd1
MD5 770b71b33bf089e919a4fae5cb1f39b8
SHA1 5f41266a1206ed8590238b4ad2c1fc9fcbf84431
SHA512 887fb3e909dd681278ce621a80e9ec8b18bf42e03871de93214fa50a4e33b81ba3923f9c1d72b05e5ddc05ac2ac037fe6ad3b1b2a7a6b77d11ba0222059eba1c
TLSH
T1A4D02B8F46800598C791DDF09BA6CE8CA793A0D414AC0C0A3018B95214D41E86613314
MD5 SHA1 SHA512 TLSH

Submit Download

0d39289b60dadd57_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\0d39289b60dadd57_0
Size 275B
SHA256 1bf9dfb0687726789012a54df17ec4cea811e9fe38e4893843c2cee982705638
MD5 8c11d9948272578675dbb8e7ee1ffbbe
SHA1 230c66e2289ed3b7b1b2fb6f4fe8e927ed8a8cae
SHA512 f586d725669dd6236caa8dd37191abac5d72dff8a26df40c86b4e1816af4bbc77e9ca7c56cfdea20187f894efb1fb01bd84ecb98a1d78196fba9262c7d1bacae
TLSH
T1A9D02ECFC8998A04CA20C8BCCAAECE4BCE0290E00829A4657808F8A266902286669201
MD5 SHA1 SHA512 TLSH

Submit Download

227342993385e08c_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\227342993385e08c_0
Size 280B
SHA256 b5f77c49ba8b2510332b01f7fed32f8a0d5c5cad0821d68d54e78e66081870ae
MD5 039a4fd7284665e1b1c9d5bfe0ddf351
SHA1 3add93f45f83ffbbbfe5bad9dc08885ecb35ca9b
SHA512 88a62c51efb544bfd6e6bb8b3d160b69203716b2a2bae57860ec2e950dcb9ba177d70c02b5f7abe8ec9a93585603499933616aa45e82b2ae041538049ec230a7
TLSH
T155D02BCF4921A504D0176CBC86954525CF1A20F0059C84C11609CA51E48476A694C200
MD5 SHA1 SHA512 TLSH

Submit Download

2be2ab398c394885_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\2be2ab398c394885_0
Size 271B
SHA256 88510fb43fa37d89667547b673c9c9a92fd371ad282e59bc0b0c900625ca0da8
MD5 c94830a7e831f281b2f881ab08b3c274
SHA1 2d53977f765eb14bee10dbf61deedb8d9fd0ec47
SHA512 3a77afce341390ac83c98f71b83d6bb0c8e47c23c4ff100662dc73c699ea815c94a46f6ec2c561dd27895949059c49429fb9c8f512c853d4d9284c98163b02c4
TLSH
T12ED0975F8FA1C70CD9C787F4DFEECE6A4252D0E16C6884458514EED320422B43605606
MD5 SHA1 SHA512 TLSH

Submit Download

2dc14dfd4915e9ce_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\2dc14dfd4915e9ce_0
Size 274B
SHA256 22543d64916e531d516947e01167a759154e428ea3c46ae35ae239f0c810ab93
MD5 3ccee1a8a96eb2148c8b32c6d53e7cb8
SHA1 70e7b67e669212156a9f502ccf35c0da2db42738
SHA512 a1420b18f9d09d485838c67af29309277282d41bdc7213abf49fe2d7ac3521b7d9d882406130b8c4d061fcc15868caf958b441cb78eae637f4e815b40f4fddcd
TLSH
T18BD02B1F8A959241C21498F48FDA8F11C30E84F021FE8901A208FC815480A2F2758244
MD5 SHA1 SHA512 TLSH

Submit Download

2fefc389f5e099cd_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\2fefc389f5e099cd_0
Size 274B
SHA256 f37e6573cf2c236eae04e1f839535d0e4d0fd2a81d7ff0d9d413f0d579d53669
MD5 8a11eff1328e2eeee23d2357ffa18285
SHA1 ca5328c18cae536af95cba98148351348ba6e152
SHA512 81351844feb89ac16defd482495f499d5c2e2c26c6833870bf5521c6242a92d69903e4aa158516adae86bbebec776b85b874accc850532f8cc2b53c7088253cf
TLSH
T18FD05E9F4A81A544D53888FD4EBA9E65C30E90F0843AE562B21CDC952280A387A68649
MD5 SHA1 SHA512 TLSH

Submit Download

328cff54b1aaf628_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\328cff54b1aaf628_0
Size 270B
SHA256 14c394ddd074129ba8162f9ee7d9fe4b935b8e76568ba969296ceec2f3485cc3
MD5 b30b10c8493103b3a8cab5f9cd45fe9b
SHA1 585f806fb0cee13475ce365dfc7bcf83566cf343
SHA512 9034ee9ef6453a1d07defe7a5610e7ea36c6397f1199a19c7cffd00f7f1bdcd30c323cef1ab2349cac23e665e6ddff0be2c06f5b4bfaa8a577e413887956caa2
TLSH
T165D0978F8A414600C1AA2AF6EFFFC956C39350E024E948D12600DE2263466A9AA18728
MD5 SHA1 SHA512 TLSH

Submit Download

38a0c846e00b5276_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\38a0c846e00b5276_0
Size 280B
SHA256 d9cd62f2caab4fd1907d70db2a582f0385eac718e6b8ddafea236e8b81643788
MD5 354d67ed02f1a0044f1a486e550fcaae
SHA1 773a8e14e94fc194e29bf2708d8160aeea119c64
SHA512 7b7348a2b3f33140f2cfd756558a8c57a59cd7d66f457c74ce1c0d84807f5780747667980255299bfef4e8130d93ea39e52bc3aa1f7a8ea8040997386eb2c83d
TLSH
T1C7D02B5F8560A808C8218DF49FB9C517830A90F0006C4008D101DC6C2B807643278319
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 600B
SHA256 22fac580bb778ddfdc517f4d1ff740067b79ecf3618f7db964ca1f2273f4bc69
MD5 40a260ae6f6fb5cf6b6e44d4e59b0787
SHA1 b61d63c57da16063e0064495fececf958bf97715
SHA512 2a320ce69402ddc7b689811f3386fa47df2b637f8932f8ab85fd804dc31ce672233f271de147ad6c642a39349e95c181c9ca4712854dd62d760556ff21e4d73e
TLSH
T10EF0E51160C4089AEF0E12F423E0EC8130F8A8282F038FD77ACD42B0AA8FFC441C1A08
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 e71a0ee34a11d3ef173e2fe9e0a0b93d1cb2fe32e1b014579b752a89c3450fb7
MD5 154ee7976fca7ec76604fee73cc2d06e
SHA1 f0768f9b2d7c7da72cbd8715c472057856359a59
SHA512 825faa03791957f572244f365aca2cca7d6af726580f02cf859ae92b12f0803dfc971a381da0a179bcf9b72e90e370e6ca208ded14397e5942c057496032d16c
TLSH
T1D921CB1C69C2089ADF0D02FC23EAEDA070B868195F07AFC7398D6131649FFC80AE4E41
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5931e4.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5931e4.TMP
Size 48B
SHA256 bad4a9117bf0b01158af684e405f2fde078a1865801dd01d57b9c072926cdf86
MD5 9852f27cd4da90e0bf438265aa8a89a6
SHA1 44b5cdf5eb26a8b2c757d6e16d89905d8423ac05
SHA512 b665ec41f301aed6e589b7a81334ec299d8c6eb85840adc2101237310c7b4f5d5cdb0934c3824e9f68329c878fe5278da9abc8d327e2ee1298e47a95aa5802b3
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Favicons
Size 20KB
SHA256 53a955366f5c0401bdcc1f08a67b3bb6f554ba1931427984ea413113607b4c38
MD5 acd47a3c1303286097c049e03d27ef71
SHA1 97cbc74585e6bbab8ee6e10cfb7a213449a4bd87
SHA512 6707f190b607acd26ff999ca1cc64ad0853576030bbfee741ac44f334877a1cb897cb8d02b20fe3f146f87386ce3856177cd8ba1d14ff48c28aad67934e1892b
SSDEEP 48:iBmw6fU1zBuxHeE8HVpKmfmfSxHRsV2fNWAQ:iBCyux+ymO5MfoL
TLSH
T1F392A54F2F393117D7851E3E366B68B9893FD11DAF998C44341448610CF8985A03D5AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\History
Size 164KB
SHA256 f32c52be7d4ece1a3c982f3877066fdaaf6044a82f4dd25d278ba08ca92beb59
MD5 e5bfa54e10041d42e15961c4cc31ad5f
SHA1 6f2d5092f29b0f6344aad3ab8ba719cc982a705a
SHA512 c66df6c35064af63e45400c31503e6505d3dd93da0e39d548786333751b1863eb7bf0a7602cc2cfb3f6b7ccbcd1190b8a1210fa7dfeda529bb3a56e0a2944968
SSDEEP 96:8BW5N5LqL/uejzH+bF+UIYysX0fxQp972EHt/DfLVVVN6zRk/E03F41G4V:8BW5qL/tH+bF+UI3iWGV2WNVVV63uwV
TLSH
T14BF31B6E5F743301CDBD913B68E749B7597DF03F872326C66C6104B1CEE2656A02C4AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
Size 686B
SHA256 e90a36517ac6f10cf32d9d06d49c75459b374203fc8b8a2f39ee8ffcd60ad614
MD5 6a839b157026410ae95bcbf0b1b088f3
SHA1 7eded1740dae028c8670060ccc4fe616d0d49c03
SHA512 41a0bfb5885a3644267d9747da9c046d352b52018aa9774dd37962580855a574af5b738cdf07d493056f880f12dab380a09aa95722c5bca1c21808ccce6e3dde
TLSH
T1C50194A687E0C6BD8B4117E527347817CD3E0405A2287D26DDDAFBE697E2071E12150B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
Size 686B
SHA256 512f3b5184ba4395b054f3a30380d213bd0ad21d9e429445f69f661b9b7105af
MD5 e88a4600b297afdcce34c45c035fd065
SHA1 9762804dfa17e6a7572eff99915f14de15b8d803
SHA512 8bfdd4a7b40bc684d63108eba9753819b00204084afbe18a4e0155fd0b2cbdb4d23e4aca4911c1a40592c85eee9e0add6dc609199764b75f064b61d0d9f24d38
TLSH
T19F0194A687E0C6BD8B4117E527347817CD3E0405A2287D26DDDAFBE697E2071E12150B
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 89daf8e1595891bf6e1847393614f23e2437f314655aff8ff59adc3be4d2ed70
MD5 e9b00aa69196529b33dd5e87ec05f4d2
SHA1 23941b39437bb85becf30c108db12f0f3b744c3f
SHA512 6b7bad4fb78b61e7fc0c0771fd2ce9b52daeb1316a893c367b4da7ac5736978c562eeab8d7a1fd4a1f4d088a2674a97c577613f6b471b9a789abcebd9b171cb1
SSDEEP 48:T0IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBFLb:YIEumQv8m1ccnvS6FLk+IiH
TLSH
T1ADF20FEE0B29F209C5A46534E2A458C7FD2A001D8765EFE96EEA42F1BF420F3B535205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 926d45dd7aa31dd07687351dadd2ecac3bfe69a9da199381ba8442da2049420e
MD5 c963ab9d912ae4f72adee8ac49a945f0
SHA1 f8ab957a470ba2eb7cf4aab21e3ad5a94ae49c7f
SHA512 a643887b33c6152a0c728fd2b5a46f24f3453f3daa17347e81b0226a2073c7908eec072534c57068ca9ac3c44eb5158df559de5525a8bbef62b5df929e870c9d
TLSH
T10BE0C0A3013BF873003C0AB92D487D05B9B6B03401862CF8C9A3807DB0840E34202863
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 f9dad2efadf0920ca060fd01fd5aa8c96661ee1fd9a225676c040b7f7e9d0175
MD5 ea84406cbddcb259c31222798bb2ec7f
SHA1 be5cd33b171a5e6fe67e47b022da00a2ce717a33
SHA512 9b3a00572706df80d4b96810aaacafd4668cf6d5f4b61dea57c50f7703069f88e7d3105b6e7c95bfe5d7e2c5e1e10bb16c629ec37f4be3d38cdb0e33537ae1eb
TLSH
T17DE02063403BF46750790E6B5E447D059AB6B03851477CFCD656807DF0854F39347C52
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 dbc443c484a453477bbcc19da2490867f3660101ce23eb81295fd9e2806e57bb
MD5 4e357bd3a083e1d000954d028fb34e8d
SHA1 c0f6d6357c6ca27fb88c91ccdb8b9f5d0af636a2
SHA512 da0aebcaafe82435274bb90c79107fdfed1ff389958ccdbc42ffc8dff0e1d8c7183955a2faf5a5f7b2da0c1c3df654f31e01a2ae8fb6021497e87ffca8b7abd0
SSDEEP 96:stv/dpuEsObDlk+JGdo5h16Z0Vs7/x+6MhmuecJJGMkkjenK+g9ZnM28XM1C7K:st338E+onVsV+FdJGwj9uG6K
TLSH
T111D194066E24A97B4CC6E519BA35BB17E2F9606271D52E48E7F8861C04EB6CC6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 c9a1070a61a43d1548fa65cd421cdbc630eac43775fd760ca8ab0fb9430d2b68
MD5 bee45de977b911418169b6237500cb5a
SHA1 0ecb11deb11996f6988e33da5018d9c33c4f1513
SHA512 9297d723f041b621eb9b863d9f7494b2082bfd8adc3ad55c5a5e49202a4a9ad4183fcfda032c3e6981a2ae1b6fad04c521ce04fc22ee8871b1035b7e82933d4b
SSDEEP 96:rv/dpuE5b9lk+JGdo616Z0nQs7/x+6MhmuecJnWbp1ejenK+g9wnnbI8XM1C7K:r335+o6QsV+FdWdQj9yg6K
TLSH
T16DD1B7066E24A97F4CC6E509BA357B17E2F9606275D52E48E7F8861C04E76CC630BC0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 77cc6d0430bb1d151aa61eb5a1a845c660cfffcd0bc2eca6c107fb120ee2e64e
MD5 c352cf4dd030271923889e8b632a6c78
SHA1 9a16daeef45919ca6e05c61b44a490e8bc08156f
SHA512 8d5e2dc74487acc56d4e936ca1517854f24937ed77bf11ab159c1ecab304aa402e37e4d0341618a14105b94457eae1ab1159e67621d8243b5377709b6c9aab65
SSDEEP 96:stv/dpuEsObDlk+MGdo5h16Z0Vs7/x+6MhmuecJB2ErjenK+g9pHgI8XM1C7K:st338ERonVsV+FdB2qj96g6K
TLSH
T114D1A6066E24A97F4C86E519BA357B17E2F9606375D52E48E7F84A1C04EB6CC2307D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 fc866c40a22af47a54b3d38904b4792190d82b97de347ed08d9a1ddd26cc01bb
MD5 cbd0f83e65f86f4b0daec1c564abd224
SHA1 1bbafe96967bc1c2435e104c8181e354381ef27c
SHA512 38876b417216e866324aecb8246a22bbdf04e5e2a77b8f82c289cb954c757aa260d669494e62b88f6eba208914a9ccfae1b1440de1f881830ff58ab6fddcd018
SSDEEP 96:vLiRPlf/ROo1pkF5d1Lik7VaTEv9V5h5pg5+e0pjMYi82sJCgX7njM:OZvf49lJ3i82y5njM
TLSH
T189C1A5A7452DC135BF444BEBDC397ACB99A601CFC9D54C0996E6C58806C1EFC21DE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 f811554ea24232cac7094eafa41a6f0aae242e7884af21e3b1f069308579c4a7
MD5 4de641938d1871c355ea8e40c901a368
SHA1 d12af1780429cd12cd6783903c46276bd0662234
SHA512 4c4cdcc0f1a1d7e84bbcb5055609b52b8e01fa336e3c4c8ff459f37157c994ae774e89db598dee332e7d6dd43ad7946c896e24707596438a018d6899f59141b1
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Site Characteristics Database\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Site Characteristics Database\000003.log
Size 40B
SHA256 f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8
MD5 148079685e25097536785f4536af014b
SHA1 c5ff5b1b69487a9dd4d244d11bbafa91708c1a41
SHA512 c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Site Characteristics Database\LOG
Size 301B
SHA256 0dc0986532361cf74c14a3b6a176777883dbfe660dd7da7c8ec7286234b3cb14
MD5 655213e891805adad19530cffcd6195d
SHA1 fdfd25069f9592f82d913d3419ad320bf8389eea
SHA512 1615f2f7e0e3d4d284d3472db80a1b919ff5a2552b713e0f1b8d40d7781f05e01b7294f6f1ca5d9b94be4084a28c439e16fdc3b03a4e2e2fb090c4eb7c8b7903
TLSH
T176E0262059CB8E3BC74988EFA972F74CC231B000E6C911162E25E544210744CB602B80
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Sync Data\LevelDB\LOG
Size 277B
SHA256 5bfe7eac904ce98a0afff2a6b680f8546d285e6ffc841a87ac548186eb0482d3
MD5 fb610ad6723e118130260eb31f5ae659
SHA1 9e7d176cad6e64862c5805976ac9df3206d8bc46
SHA512 a15bdaacb823d665c76cdaa61ade226917d73c7b7b2c9b7fa0ca6cb4ae917cc5f117583e07ca699b4c8e6ac4e9f13e9e722ea55a3e9fd2e12eea2aac647f4f79
TLSH
T13CD0C23099CACE3ACA49C8DB8EB2FB4DC2B4A804ABC5364E4F05A804784340CB620AC1
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Visited Links
Size 128KB
SHA256 16fd1f67ef441c8c9554ef01394adcfe05c9bf1177168977c6a2dc8d2b502861
MD5 03659a56a1658eb887c7bdb422c5b5a7
SHA1 fc61b34c893ef3fabcb3a1053a36c4ab3a793c82
SHA512 f339485218d76315393fffb1156b472591f976e7b907ad46b04c213d8a0ff081057a2adf3b5d228e8eb9b6e078e40411da504e15dd5fa1417d31563a182aca1a
SSDEEP 3:ImtVuKjcRrP9l:IiVuKe
TLSH
T141D3040531451444F07DD770DD151D370014C044D135504157344503C5C40C11373507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 1bf1d78af1ea1e9a222fd3fb255988249d0b5529f04efb383903166a314885b1
MD5 50bb12813cfe760a8ec262e330b3c373
SHA1 4959842184d7d888f35a67a85205e1d28d58608a
SHA512 03e62b6a7dfaacd55348639ee7963bfa7d5c7b3e6ce190bfbd7140eac121202e3b78513706450ce8407c94569f6296f048ededa0ddb322c7c0bc3cb5af0a26bb
TLSH
T1CD8194376870A9378DF3DA0AB9463B07A6A55163EA953F95D5EC0F0D019B2CC1346C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 97de24c1dc04d86c1acb7abb83332fe56b5e052331e1717d1c06fe11015da820
MD5 60d917e9468c1e0ce74b1b65867f0d90
SHA1 fcaa9c5378197f4bb046def8b3297214eed809f3
SHA512 79fe81e744a0d96d197fee4293a5edfc59d5a1ab8bee81e6426df6632b0353759ea48b811ea7092d1d7d342f212bdcbd2e3b773289bf37f0f111b8b93af6c06e
TLSH
T1EB8195376870A9374DF3D909B8463B07A6A59063E6893F94D6EC0F0C019B3DC1346C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 2KB
SHA256 2ba500473351752b3f32dda46feb7af179023f002cdbb192584f25b376371db1
MD5 a43720f7be4b5e2760452e49d4e1626c
SHA1 8f78e99b5273214a79c70890cadef3db499791d3
SHA512 0c25ecb49532f85b87cc710a389bc40dc9a375abf6fc97abce7eb4b8f74d1b7bfef05b6770205714f94f45891a5c4ff645f5013306dc2cca011256a21bdc4980
TLSH
T153516433B820AB3789F29A09794B7F139A7591A2EB662F5096DD4B0C01DA59C5309C3F
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 9c5c9c587ec851411687919a830063778fb810d7fe0404da78a15f8eada96f16
MD5 82902656c6f06fd6044782b077191093
SHA1 9ee7813a527b9707c8ec531a3191a92a1f2ba7dd
SHA512 bee3e4318f7468f7d8f4d5fa360f2f5dfe3bbbee819e3d44663bdd9ed87b5c0950b5980a80453491dcdd0dbb0dd03b5bde960425d800ccbe67aaca0a223886ef
TLSH
T168616337A930AA374DF39A0579873B07A7A55163EA953FA4D6EC0F0D01DB29C1345C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 16KB
SHA256 e808854331a2ad03bdce4358bdb7bb3eca5c994d6db6244c9c4f62a514e4d76d
MD5 3084a47686c093a1bc425c70fe2d907e
SHA1 f8c668404b12e1ef51f0456442d3f87ce320264d
SHA512 834571071d0875f4284f447ae1352fc88296360a8ec811d5cc144905f6f005f44bfecc475a6593694b9d132082c705b06b928db269c4d1070bc6c3a14b186ffb
SSDEEP 384:h+aQikB+z/xvxjg/qhE53NBSmIyeYiisdqt9zN:s/UxvxjgC+56Uiis0tFN
TLSH
T1D2729F3B64393D3395B3EA05794A174BD7B884B3E2C56E744AFD9F0D06872D80306C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 16KB
SHA256 68351984647e8efcde4a7a6a3a2cd65105db817d52423672a8c713e47596a3b9
MD5 b409ba058d488c8ad4bf23200d7e6268
SHA1 c6b42ab7ab2846c0fc7d465b3413886d0f25d123
SHA512 d76b4904a5986baf8557f3f4628b05a773b15a6ffa625fea801a9ae2e0e5a3f8f4bc06cbc1edab7f4e55667383534100b63400e4af709d30618caf6442c7ab1d
SSDEEP 384:L+aQikB+z/xvxjg/qhEWNBSmlyeYlisdqt9zN:q/UxvxjgC+eUlis0tFN
TLSH
T11D729F3B64393D3795F3EA05794A174BD7B884B3E2C56EB44ABD9F0D06872E80345C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe590eea.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State~RFe590eea.TMP
Size 1KB
SHA256 fa28b00906c2de890432247369dde8d52bcac48eff825aa1e67ef29aa4139084
MD5 87104d60a377d6174dd8f363cf4a3330
SHA1 5839f948098ba8ae440e6d0e3533d14be5426aac
SHA512 ac40dbdd7c06cb9b3f31d533c8505dccbe9ae9a3fec0e0a8a1c70db7cf02e006174c151db812f1ea9c32c55e0836f9068022a3e28d91db58d25c4e3fe7e6a53a
TLSH
T1432162B3E4206B33A8A2630A3507BE471E6151A7D3618E4461DD870D02AA1DCD32EC3B
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\ShaderCache\index
Size 256KB
SHA256 0d85d070c01959437778464f5a64fd58085cb8cc71b06dc58e20bc718c36a78e
MD5 72581e57a4bb06dc624d43a350fa7b23
SHA1 5f04650a2646d96fb95a93f5cb5b9e391b82f938
SHA512 e30426d77b35c37b1aa21d763eaed51d341b1de07c9694a780e323708a14ade5b1cca151ab171a9e4efdbc3689cd5994bcc2969f390f242796534ba258b8ce2c
SSDEEP 3:LsOllllklkXlfJG:LsUlPfJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2892-103-0x00007FFD17540000-0x00007FFD17541000-memory.dmp

Download

memory/3276-18-0x00007FFD17540000-0x00007FFD17541000-memory.dmp

Download

memory/3696-450-0x000001E4BDDC0000-0x000001E4BDDC1000-memory.dmp

Download

memory/3696-465-0x000001E4BF2C0000-0x000001E4BF2C1000-memory.dmp

Download

memory/3696-448-0x000001E4BDDA0000-0x000001E4BDDA1000-memory.dmp

Download

memory/3696-447-0x000001E4BDD90000-0x000001E4BDD91000-memory.dmp

Download

memory/3696-449-0x000001E4BDDB0000-0x000001E4BDDB1000-memory.dmp

Download

memory/3696-451-0x000001E4BEF70000-0x000001E4BEF71000-memory.dmp

Download

memory/4848-518-0x00000232EE400000-0x00000232EE422000-memory.dmp

Download

memory/4848-521-0x00000232EE4C0000-0x00000232EE4DE000-memory.dmp

Download

memory/4848-522-0x00000232EE530000-0x00000232EE5E2000-memory.dmp

Download

memory/4848-523-0x00000232EE4A0000-0x00000232EE4AA000-memory.dmp

Download

memory/4876-0-0x0000000140000000-0x0000000140E1E000-memory.dmp

Download

memory/4876-309-0x0000000140000000-0x0000000140E1E000-memory.dmp

Download